Extracted

• • Target

    3dc6f11f42af56fb2ee55b91bb0cee231365cd9bdac9ab2b5e32476118b34403.exe

  • Size

    938KB

  • MD5

    00fc05e427d25c4bc6e3ab4160644c55

  • SHA1

    b87b7e89ee2319ff7df6250f7a9b7b87c9183147

  • SHA256

    3dc6f11f42af56fb2ee55b91bb0cee231365cd9bdac9ab2b5e32476118b34403

  • SHA512

    1534692007ea17c6218d06d1f63dbe824e66cc176dfba32c78aa7754685da5396e42f602cd3ef4eb80f97cdffec6e3aa9d71ba557adae65c0c4f41dddc894436

  • SSDEEP

    12288:JtCD6O9rHtPkqNSUHkLWke7ijsuZpE9S0yYRxR7GrRybpLGZP:W5Bk6EaJAs8pEB9D7GrRy8ZP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2