Extracted

• • Target
    Quote JQ2341024749.pdf.exe
  • Size 708KB
  • SHA256 de77f2b2fe58ab75b2a6876cc9883d59330766559847223284d764b74d88df12
  • MD5 26a528a86cad4a65522eba4db40f5014
  • SHA1 37c01731625dd9f5000cd33b449e8c6ebcba470b
  • SHA512 644f192b771c9435698cb60a803eb08281cf7ff82db82f2a2bc5defd58f81cc9ef06446a37795babdb3d07aeb83ced36081bb2624c37c756f03b3cc490487a7a
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2