Extracted

• • Target

    OUTSTANDING INVOICE.pdf____________________________________________________________________________________________________________.exe

  • Size

    909KB

  • MD5

    0167b00f658c04b84b22927a449106eb

  • SHA1

    177e099d9470f371f53d063b9c68703cde2b6977

  • SHA256

    1fa497fd2ea5004a12f885d7dac2b47c0494aae2fbe45eb70f96a7f3bb03cbd1

  • SHA512

    d4bc3736404708398349efb8f190887c48d7d06f86115a2a51ebd030fea031230892e86614aff3a2bcd75c4fa67d902cfd1ed72a960e7dc41e68f99219d2253f

  • SSDEEP

    24576:9Tm4Qyr3+0Dda+2GBxy0QbiU+XL9XKMvO:xm4Y0DtvBQbL8LT

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2