Extracted

• • Target
    PO-11059021022021.exe
  • Size 406KB
  • SHA256 329def7ed2b3e21852c057f9db14aa69756635b6be94de40b19b95bd10e1d71d
  • MD5 c14e2f7c8e8cc81b9dca88b81369b5aa
  • SHA1 845056cffbc74ef74ae18f1535819c1fd1eaefbf
  • SHA512 fe928fb529c1c0899a1d9f37ec8c5b7dce2341639f79d1d2a3a8aa0ab503012ff0a62900ebcf7a4dc9d05382716c9747a93ea1424bcabc9173f39a418435ffde
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2