Extracted

• • Target

    comprobante.pdf.exe

  • Size

    1.1MB

  • MD5

    36caa90ad7983f4d019e45ffe4563f96

  • SHA1

    375af942d0e826b9bdd8213284790f3f88695f6e

  • SHA256

    460466b4bd3a9389f45e255c2dc48bc49f59cea7ed45f10f1b052442bb8e8175

  • SHA512

    ffd0924b4eebb237f25a7421f7f33176a96d51371b710e169255553691efda93648b535b68d273fe83a43364b33d575bc3af789de0db6aa80d72ebe4d6f1febc

  • SSDEEP

    12288:cne8ES7hCJH213UvLYu6fMxnbsEBEXPCtnJUcVpt34gv0ZGmgkddP63FRPRVmn:IEzJ64k9ExbsEBE6tJUcVpt34I01gkd

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2