Extracted

• • Target

    Ningbo_Outstanding_Payments.exe

  • Size

    1.2MB

  • MD5

    fa7f7b4b92e71a14bd56f292ab142c89

  • SHA1

    9804cd46c5bd25e805865f83006bb42c01c6fd2f

  • SHA256

    0e8f5b7bb9a8fb551c67b15bd74cf530324e939b8acd491fac54a7a64a51b568

  • SHA512

    d0bafb20dad0376cb5f417d6ac8e56bf613b3084f4b216b4e10b87cbecd40f06eddd665a9abbb2736085f316906ba73b0591a268aafd4dd62645ec3b943b1511

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2