Extracted

• • Target
    DOCUMENTS.pdf.exe
  • Size 618KB
  • SHA256 daccd93e099119d1c54b6d855d0a9db24e1ebd8eea974badb1ff6d8f0e01865f
  • MD5 1eee2f6e8d98a4229fa3d0100ca02f40
  • SHA1 281880040284f92e77498023925744f3a0efb6bb
  • SHA512 026aee31d90b84ad5f3f74eee7e2d11df0488c5bd13afffd66938df90b4a3cadb52a20085b0c793088a2fab5e791acc59e5bb15a633819d56b7cde3f7fa10444
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2