Extracted

• • Target

    payment_copy_banca_mediolanum.pdf.exe

  • Size

    72KB

  • MD5

    5ab0a977c3e88aff0244e376275f1487

  • SHA1

    a11e8f73d2a01ad6ee8a8df6f400c2baa571ba33

  • SHA256

    660618df19d3cb8275659686a82d840f748ac7d1f31c974af715cc77b8c737d7

  • SHA512

    791c45a8c5a866e7ba7416bbbea60db172c1d75187c4252e2786035b8eca4442649f24846334824fe163e6e52e9c4393885be8b8a658dcbabcc1ddad5c1819fc

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2