Extracted

• • Target

    92878cdf6771032cedff027921afbec33c57acffc2203f9a03248343dbc7bdf2.exe

  • Size

    1.4MB

  • MD5

    101349630a89cb5a6c81a0581355ec64

  • SHA1

    26ff7d296835f5c7f697214aeac6daae83195b99

  • SHA256

    92878cdf6771032cedff027921afbec33c57acffc2203f9a03248343dbc7bdf2

  • SHA512

    032d6f63d648497b098f727ee8b014142a7d7b1b9bd83cbe6f3680ad31cb0cc8cb543e0595b75d9bb73fbb9f158edf02b4d87651b180ee465cd80aec01fc5135

  • SSDEEP

    24576:Y5lV81KYSysCGKa4ZTnGp3Ip72oY2Jjlr1mrA8C5pofK:ElGKYcyfZja3Ip72oY2JjNX

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2