Extracted

• • Target
    Prompt Payment for Invoice ~ Contract ~ 062020_PDF.exe
  • Size 509KB
  • SHA256 4ac8cfd07f9de461909fe96b77f2a6954aacba367ce572b45de2d56eea99672e
  • MD5 7b31a7ad9ad919036034aa35d81813d1
  • SHA1 5ddb0aad93289a9942294764f965cca6f3ea9f97
  • SHA512 701f579b41452e54b1b33a7d0f3d31e63062dfed8f02415ba45ab2339817a88acef0d5699bb930591c124b0d8d3d162d26b0d6a5637a355f55004e8013487d0f
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2