Extracted

• • Target
    Shipping Documents Pdf.exe
  • Size 852KB
  • SHA256 4eeedf302a790ebf73335c3bb2d579c9d03e4a13893aa7a9c98eeb2ca8a9576d
  • MD5 7ccd0dafabb49509739db333afda6812
  • SHA1 3c299a4ec5e249f89f2c79144446e6d30beaf709
  • SHA512 66b5604403b968dd6bf8208014827f59f99395e08c20fe35a3ea3c27bed3b3369ffeeb44daa45586127f1a7afb3c1b221fb2c6477b3913cead1337c688ea23d3
  • SSDEEP 12288:r0cvG73htU7/2eQ1x9XPIn4IkiPtDy8mlJ9hWvs6SbfexeAM:r0gG1tCueimnntDy7lJ9gvs6d
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2