Extracted

• • Target

    31172a6da2d4b232acc28aac3e7345a428f73aa67430f5da1ad436ddc48eba33.exe

  • Size

    923KB

  • MD5

    5aa33c0ff774e15ceda6fb3f19f4bc9c

  • SHA1

    e473649407f5dce2f99f5ef8b26210f73f887292

  • SHA256

    31172a6da2d4b232acc28aac3e7345a428f73aa67430f5da1ad436ddc48eba33

  • SHA512

    59c9aa58c4fdf713deb339727f6faf2e1c64b6fdf4df8568eaa6216d236a521ed48f991cc839fd5f7b6856e68d30452dde57e692aad7d018547fd8fb4e614cf4

  • SSDEEP

    12288:EQwGNnSZcCyKxaP0AO9ee5dR6MOMeF2qSafV/wcE0yE9kkDpTQ7UpikAOROPrXkb:EQTgZc9U4OBPtSfVoe9kR709k

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2