Extracted

• • Target

    d407e86fb5c5596f51c80d08c5bce3a2

  • Size

    836KB

  • MD5

    d407e86fb5c5596f51c80d08c5bce3a2

  • SHA1

    50babfe7cdceec4b84007f163d57aa4daa2a5e95

  • SHA256

    bd3546f8e551a2a3aacaf46a51f8887a43fae6e0b4ab1ade4f83eb5a890fb4df

  • SHA512

    c70318103e9f0d22e0b7b07636b006b20167af25f454271be4410737faca721f71b453c1493a90ec9ca781e6e8bf7e6e720baa3a72c6f9cc02cfc00b019120fa

  • SSDEEP

    12288:EppoR65AXwgFvuSSYhU6TzcYYpRVBLoeg4PJoyatlOGxqF5/9wLaT/DhDNBxqN3g:ipoR6qgGYpRvkeg4PJoxC2eXIw

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2