Extracted

• • Target
    11. MV Golden Incus - Ships Particulars.pdf.exe
  • Size 547KB
  • SHA256 b186287c6298b4ca285cb9da1e82ffd351c4195f7673d93aa595aa987cb01676
  • MD5 de559530c89eb0d34e63d9aa5e3dc512
  • SHA1 65fee239aee6ac811399a4271a79d0868c2462f3
  • SHA512 3ed5c024d219fee98213de9e822303b29ab84195cd3706eb8dad21a42512a09bd775c2d209d924a24b9fb1694c35de3c0c591f3d107291de5e5b5d7a17a2e671
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2