Extracted

• • Target

    Payment Copy_Bank Note_PDF.exe

  • Size

    388KB

  • MD5

    564497b4dd4f071cec6aff95925f2399

  • SHA1

    1450df447e589ad7f92d73a362dd4d6f57b51a40

  • SHA256

    59e51498dc405d419b015e54bc0b183c3a81371835cc3ae4f1f1418f9619f2f4

  • SHA512

    e4d19465466c038e3e86762e72a5e274fbb5dd513034300778b3a76bab793dc40c4702015765a9db6b31c296c7112e63cfef5f3ed9b7b89a4f8c959356b3c57e

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2