Extracted

Extracted

• • Target
    PO288000174652900_pdf.exe
  • Size 549KB
  • SHA256 4e66e70ef947e8c220665cd4a18464d76aa7f80082cf202632749d5217cba611
  • MD5 293a9b73d10004b0a6c00e3d820893c2
  • SHA1 5f83206f0d38df6fcf03f491e523dba4ccf8e68d
  • SHA512 54ca1b7081f973708aff6bb49bc48f5b00e141165cc0c3c36ff24123a5261026a3cdf262ab917d85170cc51b2e99b629d41664f5d7a924198333b82a7270e57d
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealersuricatatrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • suricata: ET MALWARE AgentTesla Exfil Via SMTP

    suricata: ET MALWARE AgentTesla Exfil Via SMTP

    suricata

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2