Extracted

• • Target
    rPEDIDON°1525_.exe
  • Size 578KB
  • SHA256 d26b936b2d61001819fc4e99a224224d35edd9fd716bfe7bc5dbd431f584150e
  • MD5 d9380760cb8961a7aabe2fffd83b1296
  • SHA1 70c61249c207a0d42fef27f830f978fa5ac9610b
  • SHA512 2602f887156d9feee028f559de2ce282bf43bcbd1a008308d3e11996d5ac159d07249f5e57206ff646fbefdd2e9910558751937b33a79de7f477dfd04430c453
  • SSDEEP 12288:l89hFSSKDgBzCddx27SuzW9KcfTAyrRQ0tqwDhp:l8bs7DgBz62BWwOAyr6tshp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2