Extracted

• • Target

    PO-20945321002 & PO-20945321004.exe

  • Size

    209KB

  • MD5

    1148c85897a1e993f4eb0f08be37ec0b

  • SHA1

    fc6cd75c16babd85ff8df1b4e0fa5edd361758e8

  • SHA256

    b4f5ab297be81516ae9c0cd602d0bcab9050c8321b5675dc1ddbfa99be09f9af

  • SHA512

    5e191cd8bda0d9944771fd17f6dd90f3ad18d1b137ae11fd061562820642f5a9fc0006f3e1ebfba3a1856ef5cce7bfdf609310d2486fb5bb98a38ffbdb075488

  • SSDEEP

    6144:U0M9XCwEB3fGQZjtrjYqZjZ3aTItQYFQwjgTG:U0MlCwEB3+gjtXYs93aYMa

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2