Extracted

• • Target

    cf87855e0b967b5902a50932cfeab8aebefef4034c9f4bde31df448e28455101.exe

  • Size

    501KB

  • MD5

    3796b911951b048081a1a7829465f85b

  • SHA1

    d07fb3c24272525dcb467445e3ddacf5072938a9

  • SHA256

    cf87855e0b967b5902a50932cfeab8aebefef4034c9f4bde31df448e28455101

  • SHA512

    9f549d4f1b156e9fd129950f69583f3a9156bd40230b6fb00d68a42c35fc8f7af6b48a7bf08d6fee254667a5e3cb496cc11afafe39d21b1b760c1be21b62c467

  • SSDEEP

    12288:y2ZyhvUi2iNPmCEdbrom61QUP7faoMNp7sklOYT:pghUi1lEdbrKzyJg+T

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2