Extracted

• • Target

    Euro Swift Copy·PDF.scr

  • Size

    1.3MB

  • MD5

    b67a90c8381e471791cc4e5f7e43829f

  • SHA1

    7ecac5583356989ae599e6a1a096c791b350e7c7

  • SHA256

    6e19455a9618b20fae8404a9b3c9f4f37d2b2cf032faf61d3837b59bf9497666

  • SHA512

    04a8f5ca1793c2bc35451ab617416d2b93a8be3471bb73305d359c96b818b2265e702e37425ee2aafee5e3132cd1a01e235df1174bdee23e3a2b1e694be6d555

  • SSDEEP

    24576:zCdQy7r3oUV2nJEFQ/S26klFhX1Ar7QemnokIUSSm0U:eXgKF4S2z/XOed

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2