Extracted

• • Target

    088021ord_#PO.exe

  • Size

    1.4MB

  • MD5

    300ba4035c456e004ebd91feec81e2f2

  • SHA1

    89aed8ca31e2c3ec2208d3b82151e13a2fdbf812

  • SHA256

    96b854630806f4f57fa28534d9b478907db67c016bd606ba4b0d31af56f12d48

  • SHA512

    86d61cec3d44a1b0b9aed4cfde05a79aaf3dd798280d96dec4f7f3acc8800a06ae9a57ce2373d4ff9926b9ea86e9c3f8879e1bf1ef376f3ff65de50941b93203

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2