Extracted

Extracted

• • Target

    Invoice.pdf.lnk

  • Size

    2KB

  • MD5

    66f5251fe4fc349f298c82e8202240ac

  • SHA1

    b1e901e269720b9907ec05850300b61c18053795

  • SHA256

    dd6426a7b0c6af78d31e3868b60fa4311e16094e27b553978505a95e93eca22a

  • SHA512

    0187a44d7f7b9f9d1cbb62c7a41fbc2dfd66da31d3d144fb85cb54d290fac602fe85103d2e739287ccd1ef759b1f55a55f3c8de91dbee4f3a61e5cf4f387b9f3

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2