Extracted

• • Target
    TT Swift Copy.pdf (4).exe
  • Size 879KB
  • SHA256 1dbc1c2ea41a79c3046b9f0796248ba48db207c93fb7c1521e81763671298144
  • MD5 036fff1f570f31cf933db72e33e66091
  • SHA1 dbc6f569dbe354205439ae494608979a1a433d56
  • SHA512 9e965c7eb525d473d8147035345ddcc2ccfc00656faacc2f4790be6feb68e63181971fdcdc0ffceac7fbd8c34a851bdd0229dca403dd64b29c399baf1650f71b
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggerstealertrojanspywareagentteslapersistence

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2