Extracted

Extracted

• • Target
    PO#HG666788YH_pdf.exe
  • Size 327KB
  • SHA256 f60f5975350a5c5ce7067446e5b1ebf033c4dd6e84e8246bbfd9779762ddde8a
  • MD5 126ffecbf57af645ced6c06af4cc95fa
  • SHA1 0398f34b509ae3f90113366768bb8291a080c9d4
  • SHA512 20d11f90851a8c8c3dc17d041d491e5b4541153345dd8f6836e8f42fadd08f3eecdefa1737fb90eff19327005cf4ff9d2e1f67a92821f8f071c32423cb8cbb70
  • SSDEEP 6144:6UuU5sGI36CU13OFYf4ha+ym1btOaERstwpBCnd:6UCGI3dUlOUp+H0Tg0B0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2