Extracted

• • Target

    BankSwiftCopyUSD95000.pps

  • Size

    99KB

  • MD5

    7f0b415d0b7a76530b2f510a910811e5

  • SHA1

    480594ad26c91dd9d719c80334285375540dc83e

  • SHA256

    8d3e1d1a1775191a33980069f500e37f22bdcd0a1ad3544ab4a9d0a651fbd019

  • SHA512

    d9b3320b51f390a6f75e7e3102044557e6476103c94ec4451819b78b4503f8018fee7ce8f70657473b310b14b752935fac2b7e5caaeb318e09a9af317701d8f4

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • AgentTesla Payload

  • Blocklisted process makes network request

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2