Extracted

• • Target

    162cbee9afd2ddf1689ca7a01161c8dd

  • Size

    872KB

  • MD5

    162cbee9afd2ddf1689ca7a01161c8dd

  • SHA1

    11410b599de59f6a683ad631f91f85157d9cf466

  • SHA256

    5ad45e7314fedc92068f3df1d94ea6f97c29f05e62f0e591e38f126223e68a71

  • SHA512

    4e5d815b44cf0e54b71fd0830bfd13803fd1c2436d5a3c093d4e2ab2506f49ba86e2f548435d3658684c04d9ce6f6ca928caa9134f29a52b4920cda51b3db465

  • SSDEEP

    12288:plhF4yh+JCiwcYMEUcygb5wwvk1Hncz+Ga0T/ZTYw6Jsui/bajgcwo:LaJCiwhMg6wcB2+2xT

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2