Extracted

• • Target

    vaccination-certificate.pdf.exe

  • Size

    308KB

  • MD5

    6573f8a43ed03a44c90ae4b2f24731b1

  • SHA1

    4a91bbb558f5e91644e2d1cf97102a8ddba7646f

  • SHA256

    f18a287530626a1d2ce3d73394f16cd7d5e2b8cf261c21e8c53bae9c48a5b610

  • SHA512

    ea364baa2b9acace5766564538b5fa212411eb38055292b83b38d806e07390d6eec0393f0a5ef3be4f9c5086a9928804ccb8eb4585270eb1a32c3848de522fb2

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2