Extracted

• • Target

    22504701a85bcb07b387cd1132fc650ccfd605a6dce08895c31930d7a7dffe43.exe

  • Size

    412KB

  • MD5

    5f156b55ae2d4aad423be930307fc5e6

  • SHA1

    e3ddad2cbbceb520c61b0a9262d868c7cce42ddc

  • SHA256

    22504701a85bcb07b387cd1132fc650ccfd605a6dce08895c31930d7a7dffe43

  • SHA512

    e02bd26b1bbb0e22b24cb5906b758e61cc59f572b60fdc56191638cbfe7ca77ef72da05d2a57a42b6ff1a16235e128f933436a557964dc38949a25fd50631bad

  • SSDEEP

    6144:i3YYclrhzl4XPsASoLdm3ClEgDx+cocG20vmgNIxSVgs38buvFSAoy32:ioJtzl4/mMdmWEggiG20jIsVtKuvF7m

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2