Extracted

• • Target

    3c070b90123187dd109cc6f75176b117eedc4e13540e8512b5b989bf0fdca790.exe

  • Size

    39KB

  • MD5

    0cb635a72976bbed4648cd7dc0f00fc8

  • SHA1

    c6412f78283481c67d1aad70e7140340320337ec

  • SHA256

    3c070b90123187dd109cc6f75176b117eedc4e13540e8512b5b989bf0fdca790

  • SHA512

    47a993c9eb3f95cb64c9d0989d68e3c9b840f624c46e88cf072c661d4f23a3cd864ab5aaf82c4212c2b7e2d440641672b264e1dc72210703ddafb88b249c2b3b

  • SSDEEP

    768:zwqw9ep/Q+8Nb4cRpEv2bCj4Tf8c0JVzQA2EUJCX:8VJ2tBDJVsAyJ

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2