Extracted

• • Target
    Specifications_pdf.exe
  • Size 758KB
  • SHA256 1b309fba5ed6a5cca9df11aa42633e07a7c64d3b4474849a0ede645dde5c0a50
  • MD5 b16281b993b722004bd111e7630bfe41
  • SHA1 9a4f5d62350cffa4e80bc2686bfac6f61c4ce5d6
  • SHA512 c55fe674e8339976367704cf1debbb10a8115114ce49d3a0582480fc6264e924e57cfe719b4e27e0658c0a043e88caf0205c9776db7e26b720cc153ea4afbcd8
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2