Extracted

• • Target
    PO.NO.018191019.pdf.exe
  • Size 479KB
  • SHA256 ce026bee1dbbb52c3350d99531f92ee2cfb8426d79170b839d79e74b99a35e96
  • MD5 f5251ee97b36d6e74f2ebb3b116d3faf
  • SHA1 c656a3d1a7cbe762c6fdd06876d59a27c440bfeb
  • SHA512 c925ffbc6cb321ea699a97562e0c842b3f8d44c52fa0a65c968e144e4ced552caf8b060db4640be3ecc39245eea579502b0def857782d327e8aaf5fb43330154
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2