Extracted

• • Target

    CERES 1016 REF. 6372-2023 DESPACHO 62446_pdf.exe

  • Size

    131KB

  • MD5

    a9902b9143674d54363cde40726a59c4

  • SHA1

    93e285ad698d326e4e49688618002d3bf50964cd

  • SHA256

    9a32713b0ede9270dd80f0a3aa855fd4cba619481c24da09c9caad7ca4811742

  • SHA512

    2d2275c0631146fff3fc8a10b74463f58934c030cbf4c46f0ab1cb7a07f7bb69d3dd9151ae4b1364c672e85f8bac9f8c74abba3e1a9b09d51b651f76b7849bde

  • SSDEEP

    1536:DQ9u/oH7iV1yPasQpL2YU2Iz3GeQTaujm5hgxkozPVubKavG4XyEoq0TZwOlLX/k:DAGPpU6wlbqmRUhqJML1IZ

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2