Extracted

Extracted

• • Target
    Payment Advise_12.05.20_PDF.exe
  • Size 460KB
  • SHA256 eeed4aadeffa7f48a450e56daf3b604a46698ad3deaaaa1c12a9cf14f7ae1be1
  • MD5 29a0273c3fc2442a8ccf970aaaba54a2
  • SHA1 d4f551bb3a8e8cca6b71a7bdb6820191347c1a16
  • SHA512 806c0ede540aacb7bf5e7a92a664cb2d02cb09c2259c40632f45a8a5fa366589c1968f9fe54182b8ab8c40afc0ed7aa78504f7b022e4ca5d52e83d9b0f42f58c
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2