Extracted

• • Target

    Remittance.pdf.exe

  • Size

    841KB

  • MD5

    b45ac3d395b7354fa58ceb8b8a7072f3

  • SHA1

    3ca84f5c556dd01f8a2e915d4e5b07d9f5083299

  • SHA256

    47c89c8b504cdbd28b1e573025fc005b8a89fe4e7e6d61a608921881f41a7f44

  • SHA512

    aedda4d74bff532731262c33c235b344e89ba06d13bdd67ff346181d03c03efbc31e54c6d17e97850fa3aa52ca7ff0705b961dab0ffd2b267d802ce10833bb1a

  • SSDEEP

    12288:u9XncwoPeeyy6/32BYGPnVkoDt4EzQPS6fA/dX+PDI1mPne+ox1bbbbbbbbbbbbh:MyA2BYG/ZDtAx+8PU

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2