Extracted

• • Target
    Ref 0180066743.pdf.exe
  • Size 448KB
  • SHA256 cf78d720b952f47e38ca1dd75324c32ec650618a2b08fe3d4d9093b47830b8a1
  • MD5 3d3f4d3a177ef5292ca8bce3ba530588
  • SHA1 e09291b711292b31708962c7d761d98fb8a289e7
  • SHA512 40275b1b1a0a1e338e58b2e82b55d9cdfbbf747aeda04060b1a91e5901383ec426145a37a3484a1f4274dcdcad7fafe6f0a8c52a6136cdf530ea956c62077ef2
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2