Extracted

• • Target

    Temp.exe

  • Size

    740KB

  • MD5

    553eb950e3eac3ea2d9f17d53829efca

  • SHA1

    c75270b5e4d375d2aafdcf304e6c0d2997550384

  • SHA256

    bf96c7f0b0568187af9d87b440e5637818e606445e738e7d0e40b8fd078ff5f6

  • SHA512

    661386e687f6a773fe54ac964a73344c72ac9bb4ae9198f808b2a9d3092ff50e118e6f2fe241cddbb879811167e3ee0417545ef61e3f99cb30bf9d448a073837

  • SSDEEP

    12288:Rd9EOmlKGsiry/EmY5ZUDVL3UuFqJk4Sumz:5WKGsi2/EmY5ZUl33MGNz

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2