Extracted

• • Target
    Order_011-0421-PDF.exe
  • Size 915KB
  • SHA256 63ebe3b6b4c74b82cc098f5ba4eccf9e100b0fde5dcee78347042f357eb1b5d5
  • MD5 bf62874df7967619c0866a373fc5586f
  • SHA1 21ad8d92a9d739768ea574af1a3106f324a3f1aa
  • SHA512 d5b1b5ffad85122245a3f7b55dd100588d539aa17e24dbb044dc3c3162439bbefa3b02b85ce38221c11bbbedc333e50be330dfd7474f928315720e46a04bf8dd
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2