Extracted

• • Target

    02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe

  • Size

    958KB

  • MD5

    289e55682a143b7520cf82f16305a54f

  • SHA1

    2cda815c055ebdda4d4dd812176f89acad5d6300

  • SHA256

    02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab

  • SHA512

    8a4cab565a12e4c0bd599de27db5cf0254d5ea4e5cb30d7610baba5967cb7cdab693224710440cdce4b50bc9e1c0778386883d91ba14dd48eddb855b072d3c1a

  • SSDEEP

    12288:VM+ZDpsy8NLgmHCViuUxIZb/iPLq/rjI4rGbz9/b:Vsy8WWCEIZb/iD23I4rGV/

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2