Extracted

• • Target

    27e2722049ed670474ba068763442df1a11930feb437552454801ebe9e59d59a

  • Size

    728KB

  • MD5

    cdf4d3afa2bee0bf7815ea21c357fcbd

  • SHA1

    14bd588ba6460c3dc6351b54936f64f7261a7e4c

  • SHA256

    27e2722049ed670474ba068763442df1a11930feb437552454801ebe9e59d59a

  • SHA512

    490b7c341d91f483aef5f24b82e872d88dd278d49bee19e7051aad9af460193ba3d27e11283784c32b0d970f645fe7e1a11492020ecdf07df41d2e890db95238

  • SSDEEP

    12288:PAYAXukOaVQpmyydTlVQnmI5dj39r+ZNJ+CRW74FXHMNya0USBx+R:xLz9iim8jNrlGW7DyaWx+R

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2