Extracted

• • Target

    IMG027800pdf.exe

  • Size

    361KB

  • MD5

    306984174b43fac8c21985a3e09b6520

  • SHA1

    a57987a6e0311de215b421a819fefd064850877d

  • SHA256

    d4f74519db4083f87d03d07788b886fa2903912d09697cab41a367658e3d532e

  • SHA512

    9fe0080f557de82eb62e1270d3d16358a5fc4a8d38ea4363b9537df093a4c6a318f02f2d41492f1916180a05cbca47d84b8a2a94299d290341cd28dc557ac212

  • SSDEEP

    6144:/OqOJ4XcK0RGErRiruWvn5nFrB+e3yzBGZWPgSzsDQhlVIPM8R8yXT9saNOTYR5M:2qFsK0RuruWvV+e9ZWPpuQhIPMHkBsar

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2