Extracted

Extracted

• • Target
    285100727000782928_PDF.exe
  • Size 815KB
  • SHA256 1c2bc3fe39eadb67c0a9712e29ea2f2daa523eb3440606a0348827c3f84daeda
  • MD5 c01acc1322d2518ccb572db1735d382c
  • SHA1 2cac88121728a9a553b504a9d63e8d824e008387
  • SHA512 81546e89e113b524d64efbf8569b15a972ce6954bc340e8e0e43357fe21727ee48da8ac291a6816c912a83d49a6d4309235d4fbe410f4e12814455fdd3da58d6
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2