Extracted

• • Target
    SecuriteInfo.com.Trojan.Win32.Save.a.1532.30053
  • Size 780KB
  • SHA256 20307f9c8eb3da30dbf30172ebf4e810e44d527196d8c633cea1f10dd118b36b
  • MD5 43a3bfc87d66d231c68434cd4249f372
  • SHA1 16ddccae1227ffe88cb766f1877ad4cd8f053691
  • SHA512 229b046ee31c410fa952a145af9496d6e658cd228862fe8bf65e0155a94de1a4d0a291d16ec07652230fd79ae722d59bb7c51af861474985173a0ae3cbeb02c8
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2