Extracted

• • Target

    Purchase Inquiry_pdf.exe

  • Size

    588KB

  • MD5

    a2c76f1d92fa89671867f90986a86a87

  • SHA1

    856585e784b7280d136b8129553aa0ad92a8ea3d

  • SHA256

    55aed03e89170a5d23ecff52a4f5a8ea81fa921aa37d19c3d807c7b2078cf3a2

  • SHA512

    2532fb9a3a29e473d3b5d33eae522c075b5f4a9ab77f1e8937901834c0bfb9beaf1b1e0d3bb25d9fb0ffb3bfaf9b1b3c3c4dce64e2a9be1c8f309721c2d457f4

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2