Extracted

• • Target

    MT PEARL - T.PDF.js

  • Size

    5.8MB

  • MD5

    07d87f8a2836402d7d6d121b4ac64850

  • SHA1

    2643de7c438bd735d4730a40444fd41c2eca6712

  • SHA256

    d65d4a47bce8ac5360c92d4be30d043207c6d6d39b9b2709bf37b9b23a7b5835

  • SHA512

    5dc8a13c2235ba5496f95be0310e38b4498fe3113cd7534cd6c18dd52176fcf36a31944a5822a2962624d8ae0e0f9930ca0ea2a5a3531c823ab7eaf16e0ca966

  • SSDEEP

    24576:2nZ2HSB9a3Z6opVwL2EnWfPyAIbjnwYh88Y/tIT0L66ZTF8hi/tbUDfkPwcAeZQw:Ea5

  Score

  10^/10

  agentteslavjw0rmkeyloggerspywarestealertrojanworm

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2