Extracted

• • Target

    9d176c33ea44de565823c1ae56a0f77556db319dca4453b677ed11adbcbade53

  • Size

    684KB

  • MD5

    bfdbe187b8290a14f28ddb2eb9b38c23

  • SHA1

    5362c2ab83a79d002675f251f78971efc8b17a90

  • SHA256

    9d176c33ea44de565823c1ae56a0f77556db319dca4453b677ed11adbcbade53

  • SHA512

    c10e8dbb7b2f26ba5ce843cb3ab6ed1d1c83be1786fadc16a25b91358f78e0c53f8411116187fe6fdd13fbe52165cce73604c4e98f59e71b4aa531a6071072e2

  • SSDEEP

    12288:5E6jD/dzYPbyM+kdGORb3HEuCOcpS27ybVX1XMEbKA0ENz:5tD/EmPjiXZgS27ybPUEN

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2