Extracted

• • Target
    2598_MSC_ NEW_ORDER13_11_2020_LE_,pdf.exe
  • Size 496KB
  • SHA256 cd9532fea4c331fed21dd929be9a963c50662e545e38a63fcae56cf13199fead
  • MD5 59af638ffef55d24bf6610b29a73e4d4
  • SHA1 44a65852f8e75c65ac8063be0bf17cad1f5510f2
  • SHA512 d7cc1aeb6e9627e7376ac021c4e2139589ee93859c128b0d9e24247eec8154b94ff9fe80a58493e079d0ae8a60c6fc469f753e611954fd4a83f3be6f4c9c46fb
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2