Extracted

• • Target

    ordinului de plată.exe

  • Size

    300.1MB

  • MD5

    b94505cfbac872985e054b346cc7d2e4

  • SHA1

    560a9a480382549b216d8b0c6dd2486d45e9c12a

  • SHA256

    030e5a3cc44ffe96ca6813435d259d7bc62d015474856458690d3b2d5bff3987

  • SHA512

    08c894c3bb313bc179d73eb3e6cd4c12d70b0535c8f4591223d70797795fc8dc4d8d658f9c46bbea55375ce208dacdbaed0d421e8ca669410e55e63c7f9d41ab

  • SSDEEP

    192:ruasZ144/rLlQukYzHsjgRzyaMxxxlK4QzwU9zut:ruas/BrLlQukCBwk4QzwU9m

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2