Extracted

Extracted

• • Target
    INVOICE & AWB_pdf.exe
  • Size 645KB
  • SHA256 f3141eb0d06d4ddce695865bbd38b6d1c9fa564d3ab4a9f1a5d1c0bb9c9931cc
  • MD5 d3c15d95b011a76871d3e2a21e86962d
  • SHA1 05e66c0ca4ab0c76c42080b6e90b0975966eb306
  • SHA512 1e29a8554eba003d9145b51946b3b53d47d3718479636cf9afacb4361cfedc178ce6725e8dcd331704c1e560706891726a8fd2b2122934d53e99918e8e29e0f6
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2