Extracted

• • Target

    91ff3998adf51757d7580e1c190ff9f4c12e9b2de48b56c7507824753a9930e2exe.exe

  • Size

    991KB

  • MD5

    3d0e43113603bf2f7c7773ae08d1e03d

  • SHA1

    8d90a13d1e29bec0d4167fdcc67e6710724f79dc

  • SHA256

    91ff3998adf51757d7580e1c190ff9f4c12e9b2de48b56c7507824753a9930e2

  • SHA512

    b4a9ba85c7ce0cf04b0bc578d330910f8d03e90077466d4845af58c5f1d8c951bb78b32787cd6e871ab019da132e865c43f7f12ecced5108e20e668392574fa0

  • SSDEEP

    24576:Vb34/up+pJSpEBTxv7/S6buFPTPYMXu71oPX9Ikq2rMx:F38PJSoJ/iF8M7Pqkq2rMx

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2