Extracted

• • Target

    overdue account letter.exe

  • Size

    1023KB

  • MD5

    c52a6413be880fd815cd76f4c59f1e46

  • SHA1

    157c46446ca98f68133566167b35268028cdc67e

  • SHA256

    172f73b3500990962bfa7c18c0c6e7cd90346b757321b50adae3f7ce803efbe5

  • SHA512

    1d0e82d0ef5837a8a2d79ce4ea6773384b4b13e833286881e9193496c3c2ad4a43e89e59133b75d796180f9c46888d765cc63e38775088103e664f1fc21d6974

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2