Extracted

• • Target

    AWB # 1835257406.PDF.exe

  • Size

    966KB

  • MD5

    1a490260d5a847f0f0f0d91d76cd3dba

  • SHA1

    ba58db3865114caa06f58469ccc3d9052b9812b8

  • SHA256

    e43659dac9e8276ec4f3948c5211c3c64b34b34307b1ad15681c81529c8b64ae

  • SHA512

    240a7cc26d59f6f193ebd58420793593f107d582626c32313f2904a8b316b2e22f36c5df2061f0abcedc9f7753dd3d479c4a3c06cd5c8714eac9160c0c19e2f6

  • SSDEEP

    12288:9PhNUJQSHlQhr12iNEpos0ckmPU9Lvnofxgvjrx17sPE3E:VrSHlQhr11E9V8Lvof2jrxqPE3

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2