Extracted

Extracted

• • Target
    shipping doc_pdf.exe
  • Size 619KB
  • SHA256 76eaee704d2387983c39767b3c5804eecc90d35d73b8fa7c1f66c3e8606dfc1f
  • MD5 d47c9e8023ff64b5fb92c6c4ed149e02
  • SHA1 15657f8e3dddecdfa6c6b560095fb3d68537133a
  • SHA512 ab12d6a88c60d8c24c3dda0bdb5e1af09f45b8ea19ac12d9092a807e36fbac0de618dde21286696860c0b74edb7cca7407df55b7a68aadfe82a5ed4d33f250b2
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslaagilenetkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2