Extracted

• • Target
    PO.pdf.exe
  • Size 785KB
  • SHA256 aa86ebd21260a261bf857d9ee3bdd478500e940334d4d2deb6c93ccc066cc8af
  • MD5 971e2aaae8915f45b22d58780909b13a
  • SHA1 6c787bc220ebd882482750f1178553b783aa0141
  • SHA512 b0657baa8a303a09467c2f20ef92202f95f7a18322ffa6255cca9a4b83b29f6536be3d145af4135c3bb5079b61c5d00b78d776b9bb069452ddbd93790dd51a24
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2