Extracted

• • Target

    391085720087ca47539076781ecfb5e4027f3c89bb19097b0c3d9e599cc6b6cd.exe

  • Size

    840KB

  • MD5

    aa2bbdd4f76e86b8a34746c29602982e

  • SHA1

    65afd6aa0bf71c64cbaa3076dee472d696dd5566

  • SHA256

    391085720087ca47539076781ecfb5e4027f3c89bb19097b0c3d9e599cc6b6cd

  • SHA512

    c6888740e55c03ab9c494cc0a9e0d7271ecc009393274f332566090c0932ec5848349b803ced84c5f1bdb3a873b739c4b2058971552f195e2c9d5d850fe9135f

  • SSDEEP

    12288:S3f5A6IOwgTt0Pkua0p0lZXRYQlBTPNPqt99EUU5kLQTYCS51fn7dyx:YTaslk0l1RYmFqt95dsMCS5l7Mx

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2