Extracted

• • Target

    dfe348365330a95637b9c3cb46019314fee1b363333ed91bbf1d0149b4eea908

  • Size

    195KB

  • MD5

    7e00ba5041aac26048324241b452ad71

  • SHA1

    d6afbf2d3fb24697d57c2e13f4f2550d441a7295

  • SHA256

    dfe348365330a95637b9c3cb46019314fee1b363333ed91bbf1d0149b4eea908

  • SHA512

    ca8c784db34ac2607e30debdad42dab50e8cf1469d1104d5e7bbd33eac6337d2394d711d2921c327d3990ebb5bd56ae3d15249b71cbb16be0461079cc169342f

  • SSDEEP

    6144:8MA/CIqaM6LGR7ltGqRqjEcYgTkTanTzVM3qFYi7:E/lqkTmqFr7

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2