Extracted

• • Target
    FACTURA_FISCALA-RO8177382-64083983092PDF.exe
  • Size 1.2MB
  • SHA256 5810c00fc828c779ee78f1e445cba199eaaadb90f6febdfc094c3f72b3ea5b8a
  • MD5 e9fdef2aed52c5f2dee514bf597e103b
  • SHA1 e55272fe7540cfae22fc07d65dc074fbc4682b6d
  • SHA512 014b9deff5eaeb340ac9cc5cd84c344a2fbe3b6566c83e1719b1fa13962f976fe55cc72e3dd5e41e9b7f3a49ddbc5f381bf888e8c364174be7ab35f3576faea5
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggerstealerspywaretrojanagenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2