Extracted

• • Target
    CONFIRMED PI NO. TB052-20.exe
  • Size 395KB
  • SHA256 c12f2679528a891c228349ece6948a4696fb1a99bde47a2bcbcac0ef1eefba83
  • MD5 363bf513204a8954054d935a5ccd9b61
  • SHA1 4e986458ce7c11b8831a5dd2a6cd39e63daf042b
  • SHA512 a23660ad0de7c5c2b6946888edb82049e23d6beb1d9a84179b51295e189b49478ea50fa160d70bd2d1c15607203308432af223eb86f416bab280dad052c175a4
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2