Extracted

• • Target

    Overdue_payment_issue.exe

  • Size

    1016KB

  • MD5

    38f35101820776553e9b942a9b98571c

  • SHA1

    43649461ff83ea6e5471e3088f090d37f7b911bc

  • SHA256

    b04f43c8581679d5db16a75292b9a4cb259dbd51af6ae8b8deadb85c0c4a90aa

  • SHA512

    6c2c1259bb48441fe5a0b88f7b15715736a280930767e422fd5124ab849a31141513340b07e607dcafafe559f5eace0677a27a03d38bb68f578ad943dbbb06e5

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2