Extracted

• • Target

    invoice copy.pdf.exe

  • Size

    555KB

  • MD5

    08da5cb8effb83a1bfc20d4211960ddb

  • SHA1

    48e27634adf28e5f88484d4a9b51613f01263d16

  • SHA256

    963187e0780a5447539322536555e2e3898d85dfb6762e6f63d2bc634d6fa6c7

  • SHA512

    321264e2615098be16f79206997a29087a495d4c1e351b495fed9cf83672fc1f9e304f4aa0fe3f0b247f23627eea0380961201bf9cbf1f0ef6ae57570f148a28

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2