Extracted

• • Target

    441b41d0f485b1bb4d934c51cb236b39696fae7e78fd2c8af57c7f5d958a5f76

  • Size

    1.2MB

  • MD5

    2ebac842de88ef52346e66bcf8c79051

  • SHA1

    8b12623f065807ef8b32f3fc6c68673045dbd49a

  • SHA256

    441b41d0f485b1bb4d934c51cb236b39696fae7e78fd2c8af57c7f5d958a5f76

  • SHA512

    85eb513c63f98f86da606ef72682a0d27cb27aaa9f45e910ecf8961fb61f3670d294676f33cd7f1606ff0389dad5edfd3b4a15c59e5d2835faeff8ff45b3553c

  • SSDEEP

    24576:0J9qI5Np1iRRFp5vkaxVD6dXqKNp65C65OtfG+ljq8d:md1iP5kqq6KCFwfG2

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2