Extracted

• • Target

    PAYMENT SWIFT REFHSBC029999018728929000187928311119281-PDF.exe

  • Size

    1.3MB

  • MD5

    12ae6c3917414b2680de4955a35db4af

  • SHA1

    753b6003ca1079153626f542bcfd92d53eb70953

  • SHA256

    ebd35cc9a0267195acf06cc83407165b6dfb4ad0e1a9555af9873bdf38f24557

  • SHA512

    989a7111a471f9c4e6e0a5eb3383c2d70e8b8140b1b39783a43bc9ee62731c66c7a3ac9d9f8e37b6af399f140b1d902792fdb44df95b6da2bee1c5a1e80531d9

  • SSDEEP

    24576:LUMeevo0q3GVMlILkAR6z0JnJCzbEzW3MPUV0sxBi+CaXXiRRP+gaRhFmRK2mCxz:LUMeevoTxiLkAR6Iq8aR0gB+eNdOMdCG

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2