Extracted

Extracted

• • Target
    BPC-0040910-pdf.pif
  • Size 26KB
  • SHA256 5bbe20646d38c2bb4bc38650649633c5a78522a6ea2f09f04cb6be0f3075544e
  • MD5 5f2266f12326663ac3af2262602454b3
  • SHA1 2d99c2ec11999abe23673b50f2417c1611f189d3
  • SHA512 9f32e530291b37205b75811c2ba5a7eecbe38e37e5d7e4f208ddfb6a107c947259fcbdbb612d0ad4c57f43a467f1c67d9d317739210afe9ac749380138dc3c4b
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2