Extracted

• • Target

    Swift_copy.pdf.exe

  • Size

    733KB

  • MD5

    1050f43e5e39d84c56265767ce96105a

  • SHA1

    6f5326f0a63aaa2f9aa449fbdfada18843d9b361

  • SHA256

    480c296502a2e2c8cc03eb4a2bb61e25885e3a83b104399d279d6f6e0f0d44c9

  • SHA512

    cd51b6457423461a53e846de8ff66c77b3aed19cdff2fe2303220f94bc0966ba167c9cdb13571a445234eda0d0ad1999e4a26232168ec876d6fc9e221470aa75

  • SSDEEP

    12288:MNI+cWwzr9ke96SUT/c0UPaHpLL4I9gn73+CU0:lrKwpUTE0/HpLL4I9g73+CT

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2