Extracted

• • Target

    cdc07215534b2a013cc2ab666d9a37eaebf478aa389489416159fd7034c2670d.exe

  • Size

    914KB

  • MD5

    ee17020f12968548b24f4c5f162a767a

  • SHA1

    17ffb97a8d5982952fa36950ded78e980acd37be

  • SHA256

    cdc07215534b2a013cc2ab666d9a37eaebf478aa389489416159fd7034c2670d

  • SHA512

    d99cbcbe2ad0c00a2a393c99f6d607973a7a2bde7e89f8e79a13c0c2b8e8e114d8824846a0de5e46e27c436384357dbcfd3c9b50f63b84983b60c9f425b104d0

  • SSDEEP

    24576:ushkAkeX3B5sr0mFZESjjNrlGWhDyaLzK7:u2LHHjsIkOShlLDyMzK7

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2