Extracted

• • Target

    PO.hta

  • Size

    964B

  • MD5

    89be005919969e877221b7615c6824da

  • SHA1

    0efef178cb51ff43779a0fe864ca02f0d5009dd4

  • SHA256

    d5bb7f257f07099a70c685865b65e69ad9fa16f2cbaa13b9f8109fa5bd0d7471

  • SHA512

    1b166ad46e30c333768d6dae8bf56a88b5b080ce851f2423b6ec430e5761013bc936fb3238300a94b4debe35342c84c20b0cdff89e0b6048e74171bf464504db

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2