Extracted

Extracted

• • Target
    INVOICE COPY.pdf.exe
  • Size 488KB
  • SHA256 920b0e647dfa5015702dcd1b7c2de5832711fc4930d780e6ef70b9fb59ec4ef2
  • MD5 1c537c99095ccff28101960441f73b14
  • SHA1 5df92236c04e26446401d1fc93cf7902a840ab43
  • SHA512 96931ba55525fccc02be8c72b7563d78c8dc05d25608f98b2b93489278240d689a18fa70aebe923298f8a7e6e5f61d0cc08c75f6aaa37d57fe29176e7ccf223d
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2