Extracted

• • Target

    6dea68022ac1865157082d6490fc038bda7585ab31329fd6bdd3b554854a6fae

  • Size

    530KB

  • MD5

    0841c2069574298555b6fc6a6b650318

  • SHA1

    9594c397737cf58dda9a442db8940cb7771c6c4e

  • SHA256

    6dea68022ac1865157082d6490fc038bda7585ab31329fd6bdd3b554854a6fae

  • SHA512

    7713dfd123e3406a8edd2e8070eead65c6a6b7d456737783bd0c2ac7ada0b590bb820ffa2cde0122e80f69330cfe3dd7eb4ab0aac638c079a3b3c38aa17664bd

  • SSDEEP

    6144:sGxhLqIj0vvROK1cCu+mTKZ4NYrY0WWIx+L766MrREfaA3T6FemuszQxbbEakca4:FVwZTjuf+Z4T06x0766M/AD0emk5fa5O

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2