Extracted

• • Target

    ROCA - PO - 4501226854_Order.exe

  • Size

    9KB

  • MD5

    5e182ccf4156322e8c083b22aa6ec731

  • SHA1

    3f6dcd420d043b35a81af9323a09e1ebd2662e36

  • SHA256

    feb5ecbe032c4c81268dde1395cfeb1d2a418780de95e6ec4666cd1a32c108c5

  • SHA512

    bec162fa71a618b225302523abed6cfedfc47808c00ca04647f9005d566cbf2dd2b2c56274fd7e02b11bd3b00e9b4c298ff073b8e458478a9f14c8672eb5e177

  • SSDEEP

    96:jmKoyA2mr8CvhQBHfM+Bzm6GcKquEkkDKpHJrr1qfoumtY/RZvGg8HWt2l2Jomsv:jm352mhvJ6GQu6hU27986oBXRHt

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2