Extracted

• • Target
    Purchase Order#Quanterm290520 - PO No. 0011912006.pdf.exe
  • Size 577KB
  • SHA256 da5b47ddd8d07eccd9cbe46fe79214834b10b19aa3dcf6e7bd11d4681d9e5177
  • MD5 84909a729adb9dd41fe779d6f7f9b446
  • SHA1 07590428175d6e5fd9e9c441b445fe2a1e5a7615
  • SHA512 5284fc066e43b06867d675989ae7a514601b4b95d8d42b8c592b40e71a54ece5b0f96aa9f1d468393eb8742d8a54e993affdbe4a61eb9210e344ee77bf5d6118
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2