Extracted

• • Target

    AN 250561137.exe

  • Size

    1.4MB

  • MD5

    69880aaba9535b0c33ca92856b9997f2

  • SHA1

    5a2570e89d5e74a3e55c76895983899e7f303c19

  • SHA256

    73f84a24ad71c8218e35c8e832888d45a6595130d6aeae18ccd035f90cc91172

  • SHA512

    8b0ce1c7e8effaaf1fdf4ff40cce499e8eb979c1a0bfe3a728767591e0628c66d78bbb6ae1a147693f8f5b172a891bb515e20e8e44147b7f540f56fededa6192

  • SSDEEP

    24576:pbuZB9jFRAV8uIvzuZi6hHmQSNMIh+Smf0ZyBy:paT9JRUjYzuE6hHgNNhPmDy

  Score

  10^/10

  discoveryagentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2