Extracted

• • Target

    pol.exe

  • Size

    627KB

  • MD5

    1363b11e2105d3486b2b5e8479c57a12

  • SHA1

    b9d24a83153aa0af8b1d00214096ddc75d0464e1

  • SHA256

    1a2283bb101bc94c20d48d0ad06f11ce6cb7d0ad76e117a4176b71900dd4c6b3

  • SHA512

    ac431b6933b6b46e73e958efed679986df80b8b867536908375b36bef259e4521b6488dea91c30ceb1cfd92b0c26a1f5d044ea4d824eff2eaa3280191575765b

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1