Extracted

• • Target

    SN65LVDS.EXE

  • Size

    722KB

  • MD5

    71fd045ffa2754d04fb29af569058a4f

  • SHA1

    af8b0633406212abf619ad6e766cdb6d7343dc7a

  • SHA256

    193966c2198bd342a53892d74603233c2107d10b9d8507356b41a4666dfd8d16

  • SHA512

    28e0e7a4379e2c403819f8f8e2ee7c03de842929e7376624a9b0594d7e8b68f8d16695d6551c59f46acc46371a6e81a26a087ca11443c23e5e59d18b7a0d13de

  • SSDEEP

    12288:Uc3Ceb+m5NRSMJxG7r0fSzyLnFHPuqh7CFQQKUSNiu/mi28EOlBQS5O+w2q1ACi1:UcVNlYvWEyLFHGqVC5KUSZmi28EO7QSl

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2