Extracted

• • Target
    NINGBO_STATEMENT OF ACCOUNT.exe
  • Size 1.2MB
  • SHA256 c0cf5409e5ac8c83b073bf5faa60cc2104bb5792f57e9cbf061fe111e7cf1d5a
  • MD5 19a0ac9f01ecb846b709f41c0d03f575
  • SHA1 e87f43b87b2551a552c3621682ebaff1b55ecfe9
  • SHA512 b73ebbcb2062c1663e42c471e7a3c11d0df3e3b9d43ab645d6704d42122b09cd81a9a7aa061349c23a04ad160c890d31a611fde9d8725c1cc65c82e7b3e5970e
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2