Extracted

• • Target

    orden-PO-23-016124.pdf.exe

  • Size

    1.1MB

  • MD5

    24d8621ee7b70a6a24925601483e87b3

  • SHA1

    23a301dc6e66cc130e0058b5f4750764b534099c

  • SHA256

    1ffecb8a3412fd17b26039c365fb064e79b95f63bf90d91960d6899d9d433c5e

  • SHA512

    1ef22babb12b993ae34c9ed113ac8f5a844757aa4b6e44628566bc6f0aef622f75392f3953455a813afa209673e07dd66317f594005f9d18ece538d2456dc5a2

  • SSDEEP

    24576:8lzK0pQ0s5DxINyRbk5MNyN3LALuhdugI8dnjMFct2j:85ZpQP2NyRbk5130qdug7djC

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2