Extracted

• • Target

    0e5c5af6b17972bfe1b465f590f9bc5b977286174e2d05d3cc2434c9a283af97.exe

  • Size

    1.5MB

  • MD5

    589c40269e48be003a52eba02059b799

  • SHA1

    7505a3fd114f46b0fd4d387a198c1d54bdaaa1ca

  • SHA256

    0e5c5af6b17972bfe1b465f590f9bc5b977286174e2d05d3cc2434c9a283af97

  • SHA512

    27f0ab4065d40d26d7d7b461b3e7bb20a375c6b7e790bcca49284d8b036c5779dde4ffae7e7c7a1a3ae0cb913d137e931805018aeda980a429d3d7bfcdb5077f

  • SSDEEP

    24576:HEWJhM2bTF78AEnxBgtymNsk9GAGmQ3Wc:p56AJNscGmQ

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2