Extracted

• • Target

    payment copy.pdf.exe

  • Size

    874KB

  • MD5

    19b12dc02fe474dead3c44c468554d6f

  • SHA1

    9407e38cea8b04705f433a7cb91ec25fda611263

  • SHA256

    3ccaf74f465a79ec320fdb7e44ae09551f4348efd3bf8bf7b3638cc0c1cd8492

  • SHA512

    2ede1e930e060451ebba68396cca0eb4a7dd3c65a2b0039f87dd687a5f8876db58d14add581303de9ab890865fba312b0db1f3c2cc324bf9584a10993cec4ad3

  • SSDEEP

    12288:knoQgKZ/nXt7virmWhlGLaQYImptNmkEcPbiZx8JCozVpSs8X45jOCXJWfBhib6S:kGNwK+EJCozno4RQZwbUIxxF/Xzr

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2