Extracted

• • Target
    z0bT9jkWz1l44Xo.exe
  • Size 789KB
  • SHA256 8a1e242d7dd4840b60db37d09828f24fe047f0b7d7a74af48bd3bfc68f7c0d97
  • MD5 96921192ae04dbae7758b0603b687da3
  • SHA1 9f9ebd300d4ecd9e82c124a43d2dbd26b91094f8
  • SHA512 b1c762f077783419f8c7e0a4d182c455d37f7217dd466e560e9869ad8146c21cd453040bd1e4d4984c1283d6a3fcd39760080102129cf036e08dada2a382fcd3
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2