Extracted

Extracted

• • Target
    order2020.PDF.exe
  • Size 4.2MB
  • SHA256 b9ded28215d2cba3bbb693e7ee98ca1798eab3c0ef16e5730cc9fc7f8d199f59
  • MD5 4e40af272438bd3c88a396b3dd4fdc22
  • SHA1 5cf3e46c12cc994ea5152cc9c50ba319b2e389f8
  • SHA512 864049e1bda2344899a499bd2316031fb5f1b67093cdd8219e888c2425ab70dd076311154cc4aba47a7b836f6eee904060c2605791819bd87299127f56a38290
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslaevasionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Turns off Windows Defender SpyNet reporting

    evasion

  • Windows security bypass

    evasiontrojan

  • AgentTesla Payload

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2