Extracted

• • Target

    Debit Note.pdf________________________________________________.exe

  • Size

    615KB

  • MD5

    7fbb6a922a481a1d1615ea779d924367

  • SHA1

    35c49e1c3ec5d3b7e9fb176a41080e91d2cca3cd

  • SHA256

    b6ae3f27029900241bf6ecd397a0686061db57ce48df21098bc27d365fc3139f

  • SHA512

    5bacc814c9d23576fb81fed513b813cbbd54e2e56746b0f63dfa1c61132774259baaf38f3ab3f77ea8392016e7fdfb65e4ff5fc8f664dfe7c9b4282a7c75fae5

  • SSDEEP

    12288:7NCyiRJU/Wc5qSf/rEG8sEXccJillYyPGCpG28Uc6u79Hc9+euj2L9:x5FeafogbcJybHpT80u7+oeR9

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2