Extracted

• • Target

    Material Request-MR_2023.pdf.exe

  • Size

    840KB

  • MD5

    2d9978e3904a9c5613f3863a3c210a9f

  • SHA1

    c30cf32461d2b06f4a5fe4059e440aaded3de643

  • SHA256

    87ca3582edac50a44437f9d050df3d61fdf541599ab1d37c6fb9e9984dd1e417

  • SHA512

    3bfabfa10eb5b82318ed7b21e5af587acfa5379cc055c920e7e77106c80211dd985371af733f6a2188fda999e70dfb474f4df36016f658e1b501b61d3693bfaf

  • SSDEEP

    24576:XeIagddY8iT0WMrUwBosVHREbJ76Jr8zw6R7c4N34:X+6dYzYWflsVH69Mr8z

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2