Extracted

• • Target

    RFQ # 097663899.exe

  • Size

    517KB

  • MD5

    c95c87c201c9378e1d9adb7037d2b7e7

  • SHA1

    ff1f4a1123609ea18e9c65a5b36a4e536b40ae6a

  • SHA256

    b9a6dd35f9ca163d4e76a25d642ca7a580272ea7886a6a639273ac5b732e9f8c

  • SHA512

    b54ecc0039f89171dc059a007190125365c7aa08cea2e4f049d30993000ea81e6c3efb01c9880153b3b67e557090024b1fac8d7e5ee4e7dc1d7577a60a289b0a

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2