Extracted

• • Target
    Bank Copy Remittancemt103 3782828.pdf.exe
  • Size 1.0MB
  • SHA256 f740b4f32c0d32f5ee1525c3da775efdb4cc6535fc7ef372b373c9c67f32cd2e
  • MD5 d9184fc1ad82146bfa40afd116ae8108
  • SHA1 c18683cca68c7984b06eaae832b04db329eea120
  • SHA512 5dd0adb6a8d283b5c34c38db5d2e4d80bd156f5d2fac7fe49e42faec76d1de99e7bdf83ba1c809b5533ea081e585794eac7adb62db623d9f9d1efeadef5c193d
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2