Extracted

• • Target

    Awb#3767658753 Awb# 7914840426- Documents.pdf.exe

  • Size

    586KB

  • MD5

    09bd26a99940619b261eb7dc030e2861

  • SHA1

    dc52919e7220a9e10d90e4eff86f92b6b8997006

  • SHA256

    99fe3099044a3933d4018dee43aefbc5ae8f5b720a34e0562453f95fa70732ee

  • SHA512

    d058acbf604bf8822081d9879bc326644e13a0b762dd411673353032486f7471131aea6dfb38d8aad2df3c1c4230ef264d08d103c7901d489f3847876b741395

  • SSDEEP

    12288:gFZpoaQPpr4GnZmPSN8zvbf8eYDsDieQrKs5wChctSjR1:g/QF4GnZmPVQeYsWjrZp1

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2