Extracted

• • Target
    SecuriteInfo.com.MSIL.GenKryptik.GCPV.tr.20538.12237.exe
  • Size 609KB
  • SHA256 17781abe73e2c5aca6d20dd339a34f223a4dcb2de58bda4fa6679fdb83a5688e
  • MD5 b9578402c1f59215722b06926686bae6
  • SHA1 72a63f554a7e0c16925210e6907ab314d9d7c8ce
  • SHA512 89f755be317cf3823b4f449662553576a1460a7e81a490f672cd6a1bf07d1620ec6721ad92faaa32c15b15f628393f9c14ae4f7e51901e3197875ee54a0529eb
  • SSDEEP 12288:GmBddvH8SQHpwj6LweN9KCBMT+eR1m0z+fNSLOg:JBnH8SQJh3BcQ0z+fN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Sets service image path in registry

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2