Extracted

• • Target
    PO copy.pdf.exe
  • Size 688KB
  • SHA256 3168dedd367a1c486a5e5f79304a204e1508fcde7ea4fa2363e943a62330268f
  • MD5 8d95d98fa7a0022d71440a77d12089a3
  • SHA1 612dbdad0beefad0c9bfb00168f08456dc224424
  • SHA512 514799d18d94bf2454fd0da7932ba2c7cdc2305ad02d52d8f8c35eb6997f6f8912553bb49c645522b29072640fa752d9aa90792c735c2b7dca4dc62024ed25e6
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2