Extracted

• • Target
    #300002311PDF.exe
  • Size 678KB
  • SHA256 068e2be03e22687430eff635ad02df7c819f320888095cf4879802cfdbd83353
  • MD5 9176a5355a0960cf320fcd1a8d434a28
  • SHA1 cbc04a4f98504f96d99dc25a61ab519efabff736
  • SHA512 5b3603940e75e7de210a788c24cf802a2e8b1479a288c78c617eb36786ee3c125ad3b7ef3a8f7f14111ff32a972b2959d44a6eb5aeaf39f030e2b0b94f19a2ef
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2