Extracted

• • Target
    shipping document.pdf.exe
  • Size 413KB
  • SHA256 b4d253fd7bee0ac5be341956d6dcce635957111e207bfee5af0fa9067b066bcb
  • MD5 fd3565eaa96e9357fa3cdf996c271f19
  • SHA1 51f9ceee56d698403a20bd69b8e96907c07a611b
  • SHA512 acfcfba677baa39ef8d2ca9a5444d511b52467bc913fabba235d8d8c97bbf2811fe3876fd989b19623b7bbee14e69500f25dfcf67ef7c5c4617e959ae4b45aa0
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2