Extracted

• • Target

    PO.exe

  • Size

    1.4MB

  • MD5

    ab51b833c511b090e286527580db32e8

  • SHA1

    48a0b39900158e0f5fbd804603244fd07df28d83

  • SHA256

    a017ebe5d908a488c9fe0e16c08d8dece7eeb761eae0f29a873ede41a751bccb

  • SHA512

    69d7a5717c83f5ffd55a104e8ce1253a7d724b4bde882b17f47eb100a8f5147eb1142d180e972df509927dffdd2c048e550ec656ed52e5dfd303309b9d2b25b1

  • SSDEEP

    24576:+RRHGVP2hQ9ytwN5iaJ8A4WGT9Hq8ziqBmpU4RHakm2IpBT:+RAIMh8ZjRq8Gq0pU41aT2InT

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1