: Records every keystroke to capture login credentials in real-time.
: Sends stolen data back to the attacker via SMTP, FTP, or Telegram API. Indicators of Compromise (IoCs)
: The user runs the internal file, which often uses a "double extension" (e.g., invoice_copy.pdf.exe ) to appear harmless. Capabilities :
: The malware often hollows out legitimate Windows processes (like RegAsm.exe or vbc.exe ) to hide its activity in memory. Mitigation and Defense
: Most frequently associated with Agent Tesla . This is a .NET-based Remote Access Trojan (RAT) that functions as a keylogger and data stealer. Infection Vector :
: The user receives an email with a subject like "Payment Advice" or "Shipping Documents." Extraction : The user extracts "Pasta.7z."
