Extracted

Extracted

• • Target

    8399388448895pdf.exe

  • Size

    528KB

  • MD5

    44985f9d8117ab44b63877115a904408

  • SHA1

    ea2e99618c69c4f5f297acaf56eeb08592af7540

  • SHA256

    656f6e8c763d8c9364d91ab40dc638d7beb452f11f53c6453836499c6c4fc136

  • SHA512

    6969f3139fbc7fa0d1aba6854be7e6cc5ea581589eaa0cdae5b6b4bcca871bccb0961e36c86ec4b4a1680f7b995ef3e9d961e8c85af1ea345cfa19dc13fbf061

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2