Extracted

Extracted

• • Target

    947ac03f0914498c33f09368c3faf962dd4756ee12872e3a5e26eafdb2e2a297

  • Size

    831KB

  • MD5

    6020e02d5920971b32a909d7b97492a5

  • SHA1

    a56f551ee8773da48bea6811e1a08814a6eacd1d

  • SHA256

    947ac03f0914498c33f09368c3faf962dd4756ee12872e3a5e26eafdb2e2a297

  • SHA512

    15a9ecffb1ffc7b9737392e4a10b9c100f81e91541e0d7a71d3c550bcd55c2c4b50dd39806f69fe766d2786fe7da38fc23a92106b996d9af1b6bada14a9a4f2f

  • SSDEEP

    12288:gfYNr4RCHExP45+po2+4zJIsZnUAg1jd80jT/W8u6OLCYMdBSWXqMNBQt1WBVFTw:/HEk+pJaQ8vK1tRWXhvy1MTCmp0ck

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2