Extracted

• • Target

    OQ NO. 21010065.suv7.pdf.exe

  • Size

    494KB

  • MD5

    1b9a4f0e96911b2cfa9af27eec38fc3c

  • SHA1

    c98df416f722ad677076b28d3554d6b4e8df2a97

  • SHA256

    56b4f0d1d0a0ed41109abf11275097cfd12e8e79709f829914f6a89286606eab

  • SHA512

    001f7cf1b3ff17795c82e4bec7a191be4fff3506e235bed4c18eaeb9f1eb6798acacf0c5f01153243b4e11f52268547d9dcd9b441568c2aa84637e1816312cbf

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2