Extracted

• • Target

    ORDERNO8499009.PDF.exe

  • Size

    294KB

  • MD5

    ba00772e06a0eead616a9e2c619fffac

  • SHA1

    ea3111ec44e515fe2f5ae1d4d02ac9d0a236e17f

  • SHA256

    4d62e0434eb22116636ced8950f184020db5a00fe85f53fe0372ba3dd7fc2bb4

  • SHA512

    d6accdf7b69fdc1076572df2e5f0841dc049c3add3730c55fc03b979a96624c373ea971a92292e14427e352d528f88da549580f7c6ea9105e2fc63caf889d9f5

  • SSDEEP

    6144:PYa6x02OGIaKVVp3iKngzYmYghrYqqaazRc2clw77v:PYr0LGvKVVp3i6CY08ZaazRcllsv

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2