Extracted

• • Target

    PO_7410091 & Sales Contract 0514.exe

  • Size

    1.3MB

  • MD5

    7ed3e58d0acc9137cd7df2c3de2cf24e

  • SHA1

    d242be811a8cd5c8bcef192aabd86813eaf44807

  • SHA256

    b7609fc82f166683cdd8a5875ed6eb917e6a94998c30abf3950e752fc13e38e7

  • SHA512

    9dde9ca1e04c2d9c08638ffd813f87d4218bd61c77b71ac31df77352c869a5216dd35534f6a1e0e0dd9095567a5356fc5edc4143988899c3497cfa731eab6d7a

  • SSDEEP

    24576:hiLzQFKqb7qrb6BvqAepzfhOyFWeELW6liNd5PbjcnoqiJYG6lL9BTD:YgQW7w+BSA0zfgyFWeELWgiv5PncovaH

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2