Extracted

Extracted

• • Target
    Invoice_pdf.exe
  • Size 552KB
  • SHA256 f4b9349afed77764e8478c1ba283b708f7529c9afd4e047d75fe04233e7e4ddb
  • MD5 c72e293b8bc1a7a7e513fd4b43d75541
  • SHA1 7a2328cb4c022b7cf996c1804af56b024ce15a98
  • SHA512 34ecd367b055ae15c8c2c44e24bdf391e4fff00fad5e95607cf17f184ed670ac8303e6daef65a98dc2f4d9b12ea09c4c1a4ce0f5188c6e86f680162600170f10
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2