Extracted

• • Target

    160-4833933645027883.exe

  • Size

    376KB

  • MD5

    49b30367cc4e82565b22cf3299d673c0

  • SHA1

    fc09b42732f4882bc43845aa16448db259db2820

  • SHA256

    d254745ca2edd62c5e9d3231b3131ae065b2e1759fe9916df96e6c14af59a99e

  • SHA512

    c1c727c156fc8933a71b0aec68bba4c9ec9f7fdfe0b106e0554c0d20f485823c2e4965ec66713e8f0f5557cc4dc8daa6bb5b2715836ac7a62e12269e626b01df

  • SSDEEP

    6144:QBn1tG7w8exMNhxFa0L0CCEPnedspOjYj2d8xKGAZNj1a0vC3aAeFaWPT6QFa7Hm:gQDexMBA0L0AYNd8VALjIMC3aLtT6QFz

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2