Extracted

• • Target

    remitted payment.exe

  • Size

    568KB

  • MD5

    4c26119e1dd83eed4bde02b5b39486ee

  • SHA1

    674d02ae86c8754b3f416865b100f6bb966480fa

  • SHA256

    31f4a07127c8422565a7c2e48f9b59356d56093de8e98c4bd0202c2b1e8f573c

  • SHA512

    fa6ec50a992fc76a990f4fa3377bc1fe81bf27aff7fed217fa24e321e1a17e416bba0bea452c8aed74ead4faa436deeb7b0dc8e44cd9fca61b4dc90e32a8ffb7

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2