Extracted

Extracted

• • Target

    f6e1785d52602b1898a9933afa96c040cdd9104d9d70269f22f09e600c199362

  • Size

    715KB

  • MD5

    0e3d27a7df0e554dd4c344729280d2c8

  • SHA1

    7bf808a6ccd5fe11d55df84c5ce4ac8f3ba0d1af

  • SHA256

    f6e1785d52602b1898a9933afa96c040cdd9104d9d70269f22f09e600c199362

  • SHA512

    d5885022f744359abc6f157523901b5c4f7a65d643d761e1aa15281ee7cfd2ff0cc58a4c6b64745ebd28f9a5a476f6686b36d8e9a2ecef1d73e0d05851743ae8

  • SSDEEP

    12288:s6FO1ltC+l9/jv5ANUxUUFPoLrHhXqO5gNG2TR+3vI5XjxuuRo6Dz6Im0GvD:ECU/jJPoL1XqO5gBIv8zweo2+Im0Gv

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2