Extracted

• • Target

    0026afbd9026e8b14e0db23dd031d484dfc128edfdc5cbeb54062bf11de5b8ba

  • Size

    1.6MB

  • MD5

    101e713355c6df53008f8d1ffe38c8f7

  • SHA1

    91e3c50421e9f384394b5b5adf84ad3ce808c6c1

  • SHA256

    0026afbd9026e8b14e0db23dd031d484dfc128edfdc5cbeb54062bf11de5b8ba

  • SHA512

    371a1159af686e75943e1fcef277bf8917ce33daebeb73db380e9530d6dc344a9cedf58805075cf0077a709f7144ab6e968d305f4e3141139e934e7d5ee6a475

  • SSDEEP

    24576:/cVB/3TLbO6K3vBvU8+ovY2cHzNNeBUdtiv1RIAhjLoamMiX4lNmZg0YxegPbUID:8BfX5KJiogLTNwBUKjLoyEkmZ9Y14

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2