Extracted

• • Target

    593c1796ac0533ce256b6ecf30a01a30

  • Size

    1.2MB

  • MD5

    593c1796ac0533ce256b6ecf30a01a30

  • SHA1

    5c1fb0f5247e94288ebba13d397de9ef433c8a1c

  • SHA256

    fe6c0382f552acc39f0c6c3a2d902c74073cf00e991299a3893a01f6d3bbea72

  • SHA512

    7ab6e62c7c58e34eedf304701be199f3a1aa957dcf7f502d34a7229fac2364c3e7cfcaa547ce8671c2bcd7c7a8cd7b4da3bc97f33c71103d52bdb454ca6b9311

  • SSDEEP

    24576:mYcsCmrF22OsBgo0q4wMz6d/HfDjLKnHQgd5:mn/oHMzgjgH3

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2