Extracted

• • Target
    Boleta de pago por transferencia bancaria USD_20,784.40.pdf.exe
  • Size 703KB
  • SHA256 fc83deb95f3429cec6679ff8d3ebdcc3ef8cf4944bf0b83dd4d84e5f664b000b
  • MD5 f7e4dc379ddd4b5270cb5ab2c3a87180
  • SHA1 0f1dabc652cfbff53b61b5bc1f90c116d5058e95
  • SHA512 4815a936eb0c2997ebb48baa29ebd7437ba47c5fdaf37da80e9c8d4d402a49aa31165e1ad1a22c50dae1f70fdc4cfd7e909de60160d5dee8c009ede193444197
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2