Extracted

• • Target

    eecdf61f19a47b61d84f48d73575337a788373567568d795108e9a54d4a1d811.exe

  • Size

    939KB

  • MD5

    401d1a480f9b8dc646a7bb349b7c8af4

  • SHA1

    45939070da433b5ef38081df24620d87f38a689d

  • SHA256

    eecdf61f19a47b61d84f48d73575337a788373567568d795108e9a54d4a1d811

  • SHA512

    648a7ef49f39309c675abce53c1c0ea2fe17c9ab4bbc7480f901bfecee3f5b9076be2f74128a7d0a1bdc65c9257403a27cb5d63d16e4a89d9796285405a90f42

  • SSDEEP

    24576:gH1BndpkB/NPQNRF7kVqeYVMS0k7OTP8U1T2s0O8BD48rWHFDW+1RUr:idc/NoNP7kvkMS02OTPP5L0O8BD48rWo

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2