Extracted

• • Target

    IAENMAIL-A4-220520-0830-0002708.pdf.exe

  • Size

    996KB

  • MD5

    88b3065b14e84870d2f9095620213771

  • SHA1

    703ea473236a39ccbc0c9e738c4db97b4502ba86

  • SHA256

    24afad2bf798a2fb2052ab4cbb97c27830d1fdc1cf745e00c533b2dd7d6a0ec7

  • SHA512

    dd4f87a8dfde1a46ef5c2c5ab20d263600b4427e1d20a4d918a2a6e7b8b75bf64f75a7c313412421c4f34a890953c76c3093d0d95bf2c1ee5873dca95747b3f9

  • SSDEEP

    12288:JhLuyAH96igYdCABvV8TrV0NM0gqeFYN+GlbKNfeBErfrpuZbU:JhLuyyEYQSvV8TrKNMZYocKQWo

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1