Extracted

• • Target
    JERJvJLKLeASMET.exe
  • Size 1.1MB
  • SHA256 38d02acaae50481ff6d73b2de186301fee82ebd4af08d57b0d096dd20fb8f62a
  • MD5 ba13b0dd8f95266e42a9e169b501c111
  • SHA1 ddcb5c3ef96ec026ba263f1ea6d6a0824f22f885
  • SHA512 c620af54efcecaf95443614e7450a5a60f310de1abf9edc50797f9898400d7f4df6b92d01fead7b517dd58642d9122e788f0b486b1aa7662c5794e639a64d7ba
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2