Extracted

• • Target

    e671b36c100039f36826cdc330a248aed0ccfab2e71ec3dd471bd7c719d99f07

  • Size

    596KB

  • MD5

    a05b421cbb3bf14ae825a21050478418

  • SHA1

    6e9c62ec57c4cbf37b6800d86717f8d5bd5a1f52

  • SHA256

    e671b36c100039f36826cdc330a248aed0ccfab2e71ec3dd471bd7c719d99f07

  • SHA512

    15b906ae2f862d880118cb51f9e9a12ce232fb441f472468b7136ee676c1b2b6501a116b45aa03d83b1f950b29df24e9c4ab7b626ec18580da8f659fde3a5fa8

  • SSDEEP

    12288:F8o55/Yf8hKUZ4sKyhp5vn/r6Hubixqd/1WT1kwSsCeINIIaUN6T:Gq5QW54sKyhp5v/r5bi0jWT7scIaUN6

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2