Extracted

• • Target
    Sample_order.exe
  • Size 1.4MB
  • SHA256 1be97fde78848d5f414a09d31b63a422e30404d787a5467edede763c73e0bbbd
  • MD5 0c997235d98f3d28973e8ea7f66a37b6
  • SHA1 3c4fb8847275bbcf195744574767defd195ad26f
  • SHA512 9f3e06180aa1b850d1113a1f6b6d6f66ec34d81180b960531ef59a1749ae5edb4e1f2efc5f57b2bbc35131fb3e5363d00067caf8ac89969c21eddd8f8a86023f
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2