Extracted

• • Target

    SOA 9206174.exe

  • Size

    457KB

  • MD5

    aab0efeffaee8ccddd956b602002217d

  • SHA1

    7e926e8ffc86deb65dfacd5c698134ca42dc78ac

  • SHA256

    00d8ac72e19602b0978ccc378c7e2cca282573db5bbf63d792438bee8d98cb49

  • SHA512

    968c45cae94960cf68b6263820fe44122b03270b5199c88ec7dcdc531941346a195c1c03c33c7372aa33ae02c169a432f225464e8578405d0ad4ef4b5d78c489

  • SSDEEP

    12288:LS9gOrY+/Vtrc3x8yLcJOzgMZbYZ0OY+zVGziaAUPrC:LS95TdIKyI8zgM+0gVsPAUP

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2