Extracted

• • Target

    DHL INV+AWB10261191061333374.PDF____.exe

  • Size

    671KB

  • MD5

    e9e319555f38e62a58cb51b9ae1eed33

  • SHA1

    60283ac7f4042dadce2f5ff72cbae5068a92ec5b

  • SHA256

    e79c8032538c088bae4156ffe99ad06a5e6625d5259e3ec5541a4f01c5dd407b

  • SHA512

    6caa860550714b634bef9fa159d6b935c774ff8c943d5d6f825f77a5904e183be1ab8718dfc8ce2bc7c9dff91776c09bdfbaec340791983cbb1e6b258fc22a1a

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2