Extracted

• • Target

    DOCUMENT34789208exe.exe

  • Size

    1.0MB

  • MD5

    2fba125e55b4145326e15962775e8c33

  • SHA1

    7eb926aec6bf42e00a2a68c148e185d2f3de86e9

  • SHA256

    c5a6df42235a175be31fec2a8eae40ba6263d48a207debbe1c4cde98861182c8

  • SHA512

    ddee0387b55848f249de957cdcf21c01a5ee54945dbabf8fb8ed93635e34edab36c3b5ef956e2405fe35b6f3994abb593d3a7819ff4bb7ee57815dba3aeb8b2a

  • SSDEEP

    12288:Tg0hXCPJcPDxqVPVcKNJycqM0bQOksecpF24/rUYECb0ndeE8FVACkd3/ENs5oY1:5vSPByJMzW24/gzB

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2