Extracted

• • Target

    Statement Of Account Due.pdf______________________________________________.exe

  • Size

    754KB

  • MD5

    390f382ef3a2d76e22e1a9481bcf1f64

  • SHA1

    5e6f4341178f0871ed2b5520422cfb51d3eb9819

  • SHA256

    a92454653447052d1a4d2342adeae2ae74a0499868a6fbd7834773b47b368cb7

  • SHA512

    b9d8b2b78723d1f1ba3339ba9282b395d075ac63e48b3c3927a5ec3226eef26f617aba97597e0db4bcbcb9c9ff193255f57894b40e38e7aac606b8683ddf66c0

  • SSDEEP

    12288:Izo+r8HbbwArD6L4qb+TfdMxHKmnPmcdtpf5HYUx2dv+HXqwHiDyody3mEq:u8HVDCDb+TfmlKcPm4HYe2dtvE0

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2