Extracted

• • Target
    scan copy-80808_pdf.gz.exe
  • Size 828KB
  • SHA256 a19573af6e0050d407b1dbd3bfb2966484d81e6cb6bf99059db0802d0bd2d5c2
  • MD5 8ddf8894105209206407a0656852fff1
  • SHA1 dbd8808d5f17bb0709014d4c3d79a64339815b4f
  • SHA512 c9443c13b9ade56261d6ec0e3f1b240717ccda17cb0a718b3a101dbd339eb92f3e771bf4a97df79eb08cc0ba9e76179d5486c245f965c368cb411740cabbc426
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggertrojanstealerspywareagentteslapersistence

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run entry to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2