Extracted

• • Target

    cd9ee0f4a8ad57856d636dd1f2f34c2196804791bff45332d729203ce1459226.exe

  • Size

    46KB

  • MD5

    58a83cbfbd24495d3427075426c7bb6c

  • SHA1

    3b3ef5d4ab2adc7824dd7ec26e8cc569f03e5189

  • SHA256

    cd9ee0f4a8ad57856d636dd1f2f34c2196804791bff45332d729203ce1459226

  • SHA512

    820b6b992167303c33e96dca7acbef26b80698b63ae5ff61cfe919fc34ba6e10460f5264e7e33a433aa8407c0a3f2b482618e1da19f7369a6b07d40cb41bb871

  • SSDEEP

    768:WZ6LWN+ybM6EAKXbNgotkHxPe9rB5I308Cslw4BcriEsO:W5dopgKkHxPGrB5Ik3T4iCO

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2