Extracted

• • Target

    48e030cc0ca1af0e027949d1f16b86226e352065d9bf5eba4ca7719efe61b0cf.exe

  • Size

    527KB

  • MD5

    7957ee20f42e7158e0fd2cd73e17b436

  • SHA1

    aed7c6736ede54b4d4eda9ff3cbb8e510eef2a88

  • SHA256

    48e030cc0ca1af0e027949d1f16b86226e352065d9bf5eba4ca7719efe61b0cf

  • SHA512

    853ceb5c1465ff9ec2df913f898710795517f5ca7b787dc63e9b9483d72785311f954e886659dc7592ce74269b65fe93e958ffde4935cf2cc7625217dc0f8fff

  • SSDEEP

    12288:wuvgIb5G6uxzXlsjuapg2dKhtjWHmYZeIwEw:Zu52gDbYS

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2