Extracted

• • Target

    BL COPY.pdf______________________________________________________________________.exe

  • Size

    541KB

  • MD5

    6c7df4e48b72ec647cfe3901ee36a0d1

  • SHA1

    11ffdc4cdcd4dd7a7cc42780693f70df315391c5

  • SHA256

    e774f64c2078e0b89fa7a65590044e70212823f02b0300636deff0ccb5a36971

  • SHA512

    a78197e034e45ed146cb4a2103ac47563bb0b33247ee6dc5368c5a3065454f502b6a9834617e94732bef02704c2a056cd03de00798861d995ba8fb97cce459bb

  • SSDEEP

    12288:fMCvoIvsHj5XwMFr4R04mfCR50/k1+ikYPiwkgB:fMCvoIvsFh120iR5eMv5

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2