Extracted

• • Target

    GS_ PO NO.1862021.exe

  • Size

    921KB

  • MD5

    85bec1ad53593edfc02c46dc42102c74

  • SHA1

    64df5c2489b1384db7507252ecaa5bc7c0ff3911

  • SHA256

    2b1611385291864fe7aa42dbc429f94ec4e42570ec627609407fc9889623f426

  • SHA512

    2652d5889266309814f32be5aeff089acdf833c62cd631bfde6a3d050ae84ecc28ba8104c49a527de254f98e69b4c538cb40563bfd44d96fe23e10920d2aba74

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2