Extracted

• • Target

    PO, Order#4500484210.exe

  • Size

    619KB

  • MD5

    0152c29a0311f35d715518908c2efe8c

  • SHA1

    e167834be76dcbbe7e8e3eb15ccc688376a79715

  • SHA256

    5a182bbc0b6a621737548194ea2d6bb8f2d41c30ecb7c0252a30c14508a40c90

  • SHA512

    c2911167c228ea9d5d77215173636aa34ba4c18c4651615a1979598b98614c1e90751c781810cf8d6336361b57d541d7f0a4c2d1df09c3b0b8ef3cccc4678720

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2