Extracted

Extracted

• • Target
    Fizetés,pdf.exe
  • Size 632KB
  • SHA256 8996d33ea6bf05f6bda3a0a4f1ee4fceff1b49e99112d387ea5ac87ae778fcb6
  • MD5 192b5e891c2374912f210b5470650ff3
  • SHA1 da04713fe1b5cc940d06e0171cee7f40979520cf
  • SHA512 1aa6ec06ed13d4914f00c4710dfc712546799735dbc6f65de3157ea5e436810385688c38c7b24ccd49ec0f518f984f56a021d703491b62700592c81e91ee0be9
  • SSDEEP 12288:c19lVnFp5Eir2nEb8LW1PmqZ6GMyOexd4Rd1Yi5tFS/c4A4qRxWcaqL:cXlVn7lGEgQm+6GM5m4Rd1YX9vqRxWcf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2