Extracted

• • Target

    c1b4b9ffcd81e9a4516400f9fc38a4d3.exe

  • Size

    1.1MB

  • MD5

    c1b4b9ffcd81e9a4516400f9fc38a4d3

  • SHA1

    3605dec02e7f6480262eb5cae77ada772324bb2b

  • SHA256

    4ed0b0474741e959230eb8a17efbc5e0db94fba7f46499596dd6359b4cf16637

  • SHA512

    f7ff356b06b1eb2f9babc850727907748c50b5868a241a6b4746e92104d806c67b3034a73559a2ca0819c6e4b66e17e1bbcd856ba7ca4d16d3f283e827dd0c5e

  Score

  10^/10

  agentteslananocorecollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2