Extracted

• • Target

    INVOICE PDF.exe

  • Size

    556KB

  • MD5

    7bfad62088a9d2186c233c0d346a58de

  • SHA1

    e6e454a6ae42414dc03afd6f2fade5fdf1f72a52

  • SHA256

    39c437d661ebd2816fb9228a00524a526abbfea18a3b17aba9a4abbfd7691045

  • SHA512

    4dcc820ecf6dabf93f02011ec2bca8467040dbfde10bf84238b882274abfb4559c64ef66902db8cc7f6773d6d193f73de8d44095bc456d28d1ae656041aaef54

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2