Extracted

• • Target
    178306_AT_1001459828_20220516_E_1,PDF.exe
  • Size 539KB
  • SHA256 aaecd614bb1827800c51b202b4fba750e4f93cb36d34ac6cfe0aee8d0ee1cec2
  • MD5 0bd57c5d8c4442529b727701d8a8f256
  • SHA1 eb9911a421932ab18af25f22d3ec581dcbd6b49a
  • SHA512 cd0dc207527982a3bb503dc3149f3a9e8c2f82e5a1607e5f139937057ee6210e95c03b23bc18f6d0cb8eab4afa74e9279a70c18b80c9891821fd02a4673208fe
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2