Extracted

• • Target

    Rwlleacvff.exe

  • Size

    1.1MB

  • MD5

    d4b61b8225bba66d44e311d686014ecf

  • SHA1

    4df6fc35a76fa2bb71ad182a77881e8868b1d00b

  • SHA256

    ec52c66f567af3f66c74f28a63cd2c315646a34095efc933de90151ed7df9684

  • SHA512

    79f9c98d0c1e20290e274d6702bc3d4c617102097562b26a0d4f6101463ff501b7218d188ba45ada9cd5c776070084510ef17f7e72185f31f66155690f3b9d78

  • SSDEEP

    24576:6Uu7IVSXJ7gIYeEPdoh8/D39jFSNq0/7xMjp8xs+XpVHPpm4m8dL:6sNeEhVCq67LsOpVvpmY1

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2