Extracted

Extracted

• • Target
    DHL.TRACKING.DETAILS.PDF.exe
  • Size 607KB
  • SHA256 f3861ce2254ecdb6dc2cce1060dc8cfb2dd89b53fddae82321dd84f45c7bb7f4
  • MD5 c591a02b94dc1639b74e79170d354284
  • SHA1 028b2373b9ffe0be4dea0dc725fa5e06e3ce5b21
  • SHA512 f054a011d63aec5cd1b29a1a80eca5be6f5935abf81256a9d55425e1fad7c5e92c45cd36f01e3baa9cac86de7794fd8a4bcfbffd881b6fba1f0bc859ebc4f4ae
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2