Extracted

• • Target

    4eb8046eadf341ecc50386190d0fa6172f14bf72541e7a25149a8107ad50de84

  • Size

    63KB

  • MD5

    632aac028a25439edf11cda80ae43cd2

  • SHA1

    f33c561fa166542df1d0d7e4ed0e0a54146264c1

  • SHA256

    4eb8046eadf341ecc50386190d0fa6172f14bf72541e7a25149a8107ad50de84

  • SHA512

    ac5d8a0181a9392b99e48b455d6b32a3f1872b8244a0387eba10b22ef5e744de157662bbb5beb8194763f70de64a263efc31f86eeafee0351dc0c43d6f709d7a

  • SSDEEP

    768:J7tLiSZ0JsQVH7sSPU/IS8oS6/tyQdbjGLpWie82bZl8rcKMZAs3m1TC9xmLTkda:mfsWPU/d8D6/t5jiYthwvq32TFLTl

  Score

  10^/10

  discoveryagentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2