Extracted

• • Target

    DOCUMENTS.exe

  • Size

    953KB

  • MD5

    49a624292ca84737cc6c1318ba79c37f

  • SHA1

    22dd3f01d20fda38ef2d9baf892837aba7c4ce30

  • SHA256

    f84fb6d4efc2d260e4afc8515a01646621b32a5a8e767d7f0056a3e3f0f9aacb

  • SHA512

    4f841d11bfc3f3e334a0929c7e5eae540d91c65d38ba912e127293d4999c1d34f7ee9caf70f6b7419af28a3c555531da9dab111a8aa2604cfc3f352708e80c5b

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2