Extracted

• • Target

    INVOICE SCANNED.pdf.exe

  • Size

    692KB

  • MD5

    a8a244683da47d726b2929c42224b93d

  • SHA1

    6242a7c219b3ed718e4f959bdb0d9ab95dd634a2

  • SHA256

    2690454b3da7857c0ce0fe030d9c4416564d0f5330bffcd99cd6f605deb5d9dc

  • SHA512

    0228b987423be0cd0f77f559ec38bea0adde69c0e8f715a4eba25898650af1fd639c424a81a18dc672e2f8579f5cd8d26f4e07034b36e8515c2f8b330ae0dc4f

  • SSDEEP

    12288:8+sD7s9ow+ovB5JEws92+lnCo7V2pavxFZMNp9z6z5pNnrM/9EwB5:8jD7s9o5ovRPPwnz7VaavxFaNT6lpJrm

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2