Extracted

• • Target

    new shipment.exe

  • Size

    538KB

  • MD5

    3a1635fd14ff9c17c0f65b8c393b9739

  • SHA1

    1f6e011d27ab1bbcfb5d57494610327bcf889aeb

  • SHA256

    e016bfbd170c4b15789abf7fa2ba30bec2bd785e2ec9b9fc759722833ed88a87

  • SHA512

    c37644c6b1ae9bd046d3a98733cd357051d632d926d408fbfc9a327668442b328be0aa5f56de5ebb416d772a1109c45f86aff90ab20c70bea3fd2641913f2211

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2