Extracted

• • Target

    New P.O. for W2025.com.exe

  • Size

    46KB

  • MD5

    d3c8de4b00030ddd7f5c9c6eb40f7e49

  • SHA1

    446acf91a2987bba28abc7839be81bf739a7112f

  • SHA256

    f6f3fe1f44d606a8c717d7ce911207c259a1f8844503e7513e99cc78a458d8cf

  • SHA512

    7a81499335703ee05d98584a5a7d5c15a535a6e329710779f1dc53b21ed48f13200dd51d8d77652254947c6bf2a9b89874815d02c47937172dba418400c3c8da

  • SSDEEP

    768:JMtp801KTj7nzeUwx5al8FO3+HLoRn73F/oP67+tSwHF2A:mtp801CrCjpFHHM1rFCzIwl3

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2