Extracted

• • Target

    f350ead728719718a5656299b43adbe4

  • Size

    648KB

  • MD5

    f350ead728719718a5656299b43adbe4

  • SHA1

    8ba8ed7a1e1ed7cd5ff2d5c7b225d16b5ab88128

  • SHA256

    a13818c085ae6a086b8020857d505758c9a4be67da60651ed90cbbd0aac2fd60

  • SHA512

    d847f81689ebf26a5027d43339da98ce8495cbb40ee3487efc95d2ece6ffc8582e7f44426aa658d68d3e16e84d93d5bec75db17cab22c6fdcd05e00e6c0f0cdf

  • SSDEEP

    12288:V53vR9uboUZLCYROqqBp87sVn+1PB9j7Ht9nR:V5Z92oU/UNiO+1PLtT

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2