Extracted

• • Target

    PAYMENT COPY.pdf.exe

  • Size

    1021KB

  • MD5

    28707370a3fb75269da8a9da30960505

  • SHA1

    9c900e8ca6595599e922bce6f3255f29063d6212

  • SHA256

    d49cff946605d03af069b896354b114d8a4b87313c1aa7fcac9fbf71bb39f8c1

  • SHA512

    1ceb51a47825143cce7c0826e3d378b639621972996d6b0f7af772837852a0c00fc6f671f9c8642e2372e6b8118e43596f654073134681ca3958fba62be7f44f

  • SSDEEP

    12288:uF0rdOBhhxlh/VJ1euMQd+S8Q/ZNt4/NpUH:00QdxTVJEuMPSDxNt+

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2