Extracted

Extracted

• • Target
    MRF-D_009_21-AW-Deck-General-tools-sent-to-office-on07.02.2023-pdf.exe
  • Size 23KB
  • SHA256 465a71fa9458ee9162610eae78424a2a3f75561af0a2ce10ab3e6afde10aa74c
  • MD5 8531ba62c67d13ce3ad94bcd42bb2c00
  • SHA1 a9cee94ac6fe7afd2f2647e08330ce47269c57d6
  • SHA512 a183e13a1c4231a702b7c560b69313684d08ffb46580cd3fbc3641e197560ee61d27ccd109ba457ceac33b62f1fed15a34d6fe0a67f3989b7bfe19f4e39f5c53
  • SSDEEP 96:mHoxS1E/nqEnkpB0gJ2YGkLtUzVHEHtA6xQkVbR9x5YSGOomjfjw5aBZ7bBlHWFU:y1E/jSOVYrLtF/6ObR9xFyajGaBZzHz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  purecrypterdownloaderloaderagentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2