Extracted

• • Target

    RFQ # 097663899..exe

  • Size

    573KB

  • MD5

    438764f5af1b92f873d00fdd5f5a8ecf

  • SHA1

    72c4170e13a3217a98d1056208453166af718f32

  • SHA256

    ed75eccbb2a0ba07a7ec3524633b696416994678632e2fbade0be9bd178b973f

  • SHA512

    5f3c7160c1a5f1b2b0c2697b22dd6f422b03af5d259db8dff2ea8ae563cb8fca037c0f850fdc228a2f9bb5ec7053c3ac9504946ced4d98fb626f4a2597693ad2

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2