Extracted

• • Target

    123 WHL (ASA route) SSHAS0123860.exe

  • Size

    691KB

  • MD5

    52092f980201ffce0352e5126ed0bf43

  • SHA1

    919d960cad9c7495d253f741fe56000bfe11e938

  • SHA256

    54aecbaf7821c0ee087cae191865a7df8b58408efbaec7b96b6b0dda54efd32f

  • SHA512

    ed8aa398d970628d7e5d759f0567d778eafac99807a70dde406bc0ecd1a1f57c5f13cbb7655053bb088fe81ea0b337becd9b598be49a71fbddd343b9249ed705

  • SSDEEP

    12288:fAcopox4QzSIGjRzgx1JtoZX8F8D0m3SqazJb+cgxWZqiwn4DbOKij:zeQSftg3Jto4eSqRcm/iw421

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2