Extracted

• • Target

    z0Transferslip.exe

  • Size

    692KB

  • MD5

    523420934008337bc65cd0ee6a40adbf

  • SHA1

    6e21b99481d21aab127e702a7b6a4582255ed18e

  • SHA256

    8bdb93748c95f7288c8e062db2c2ebff27e89c6e0f031f1c527016d5140f37b2

  • SHA512

    098fdae6e0265663ff49b30f3685a509bd997207bb818f6d4f837b4ec7a6e02c65d7286500e8ecdde9bf0fa167e4b3be6ff1173bdc479c49fff1af6cc2f19264

  • SSDEEP

    12288:ntwI0pW48+hNknKT7GJejOtysczjLdhys//HzrgML3OEfKvajdC8Qi5fliadEIP1:9617GJrYvXLdhys3TrgMrOEff5C8Qi5L

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2