Extracted

Extracted

• • Target
    RFQ_V40795.pdf.exe
  • Size 520KB
  • SHA256 a1438fd2ecd8a17372fde0f4920d510bce698eeb2eec5d29d67fbc15523d2e1d
  • MD5 63a2ec09db4568a893a1e95c35b64c12
  • SHA1 e5004a71b47bc3918fac346a11ea618a15b02cc8
  • SHA512 5f1235058cfccc993c832db187c8452e6974084ebc1c92673e0d1845fb78e0fcf367d0b59a062309d8c294321eb9d39aa5a1c59aec7b2d093f13ca16191a5a62
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2