Extracted

Extracted

• • Target
    Purchase__quote.pdf.exe
  • Size 675KB
  • SHA256 898fb94bb9fb9894ad31a2c4eec424aa0de35cfe8fb97f9da0914105d397ea3f
  • MD5 82c4743a0fdcf03a6542fcc1042cdff1
  • SHA1 84b8c6aba5df844cd70f757594766187c911db39
  • SHA512 b3a88d0f57c89197006b4acf3cb98fe2480ed51da28f20e42a13450b48099d86a86248ecb55d5062a411f6f5ccd1b2b42758252dd2b32d984193183b7d20bba6
  • MD5 SHA1 SHA512

  Score

  10^/10

  rezer0agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • rezer0

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2