Extracted

• • Target

    20210000954460_PDF.exe

  • Size

    710KB

  • MD5

    73496cdede3bc704053c7fb1a72bdd63

  • SHA1

    12ee7335a6d1593f3ba9ed6021feb76bc954e23b

  • SHA256

    33ac409702967bcce5d3be1695caa40e601b10f5d6607a95f83c7a22a1db7d5f

  • SHA512

    a14089abc11a0eb0b305f52d944d23b5bb78d47d54d42a7d961203320df0c57fbcaf25e4386a1fcc3b6e518c823a0ab41c0a423eaca32be0c9325df7c7495ad1

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2