Extracted

• • Target

    0372YT591445-23 -1084200-USD-SWIFT MESAJI.PDF.exe

  • Size

    1013KB

  • MD5

    0bae2a6aa443f594e55945fdbcaefe51

  • SHA1

    d47f03a14a4d42dae739e790b181c02b6767b036

  • SHA256

    24c69122ace7d707b1838376111192f2bcdbd02531521b656536773b8bc4710c

  • SHA512

    335e8a540bfa40ed4cefac9c993efa715902873c2e938bc1fdc2930a91a4b1b8888d639fe62aeb63532a289b2a9a37ea2ad34ffcaec2577bd6efd77fe06e5482

  • SSDEEP

    24576:zDdsRRFLRphclRIHOYH+V3EB9yTuv51JSFN:zDoRF1rcDIHgV3W9CuvtSH

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2