Extracted

• • Target

    Proforma Invoice.pdf.exe

  • Size

    551KB

  • MD5

    4aed86a83d6470edf10d71508c18e3c9

  • SHA1

    871973f1e5c71dc0d7e2b6bcd080be3d58b713f1

  • SHA256

    d83c9b45e97010c3c45988042a6f4e6c6c0945425853fed6f821aa0d28652f68

  • SHA512

    5d55f756f6483c075f2bec2650a8aec221fbe29f45f2425241e4a338c03eca6c01297b08d17da0abb1e2cbb038ac398f893ad25daa7c3e5432afd047830a9713

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2