Extracted

Extracted

• • Target

    DHL RPA GRBP Template.pdf.exe

  • Size

    13KB

  • MD5

    0aa04f249eaece97140ad4ff7bc00420

  • SHA1

    4cb79679a05b197ba21489fc362e0d91ae2c3b06

  • SHA256

    9ed9d37ed2bad5f93fe5f80d396c6a075be44a60312ea033a8d4eb3be772b4f9

  • SHA512

    e5a4e704f9919d55398bfb9fe3f98729084b531d4ffaf5ccf59eef83b190827f8d80c60e0e676d56c36bdff019499483b10851288b2f84f922f18c182b4b5599

  • SSDEEP

    192:k0OejvqLK915glsNhYkCeXicN+gp7cCBR2D9UFay:klLaTglsNvCeXicNrZO9UFa

  Score

  10^/10

  purecrypterdownloaderloaderagentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2