Extracted

• • Target

    payment status.pdf.exe

  • Size

    1020KB

  • MD5

    95db39b63d249c820c8f4049e0f6cb47

  • SHA1

    c7aea8439dc96bdbedb2f6c132ec3507818b66c4

  • SHA256

    411b46ed90780c211a99c7b85b753aade4eb1d5e63f3172f0a8149edf109237a

  • SHA512

    1bfe8a034f2411498768819e2c4511f657512cf8fe51c7f868557e7a1e507ca08f514a01433261b5116232886546732151c1b1f17f7af742761f2ff3afbeab06

  • SSDEEP

    24576:HR34/up+pJCy9lInPiYgpcU7GPm8UXYz1q:x38PJCQ3IPqXV

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2