Extracted

• • Target

    27f6350ec9e53bacc62ed3fd0b96cae3efeea7994e35d1fd62411da9c11d7e49_JC.exe

  • Size

    966KB

  • MD5

    4dd7a37468a9020035a1e3d7d6c87e85

  • SHA1

    ad34938107d0b0fcef7dd96b5e71df6228e083b5

  • SHA256

    27f6350ec9e53bacc62ed3fd0b96cae3efeea7994e35d1fd62411da9c11d7e49

  • SHA512

    faebde4f726c7e442b86efa8bb5fb04f7b9320fed309f86e490203e0d5498c7b36ae33fe50014d895bba30a6a37fb1baefce72cc3427cfe409edb4f836827e92

  • SSDEEP

    12288:LrSxRPj+n/SPl8A0wqUKUeXawoQ7y5hYOqshySCatW51:4Pqn/SPlkrUnSW2V

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2