Extracted

• • Target
    PO# AA01728-....exe
  • Size 921KB
  • SHA256 b9ef185d3f879ecb2a755aef91f48ac6de736185c1f16693afe21dabc70240b9
  • MD5 7b2bf102c84c32f698c158cdf1bc94be
  • SHA1 aaebeb07860fd8747184dce60ae40e96303b5615
  • SHA512 0980eb5a9b9e8e5c85321964874a025699755b4f2676151bfaadcf01a8c5fc287bbbd3223f2a792e09d7d3de5117d66cad71bb3872c29cacbfac8b1c93e2b683
  • SSDEEP 12288:DfZltGBRmJrQ5il8ljw1MP1xxgZltGBRmJrQ5il8ljw1MP1xx1k+0:bZ2BRL5i2CMPOZ2BRL5i2CMPQ+0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2