Extracted

• • Target

    BANK INFORMATION.pdf_______________________________________________________________________________________________________.exe

  • Size

    635KB

  • MD5

    f81f4ddb8a6db73ce0ffd9aaac061132

  • SHA1

    5049fd3d9e81fdf6881c2d740f5704c29909ed97

  • SHA256

    073e8de8cf8abd3c8abda997a599d7fb40ddf5e9969ec3bebfdd5f4aa7ca32f0

  • SHA512

    52486c1b37d1404fb493d806bd533668bc694cfc46a581ea68cb61617f8303f05cd191405d3390e5d983809e7dfd22f7ae863ac7a50649b2c502f8b0ee2006d5

  • SSDEEP

    12288:HCjQaueH5qxF3SW2J2IsmqgJn8VRgpm9AVPUPjmiYs5JpOxKOaJwntZh5m:HCBqxFusmq1vWm9nLmiViV5

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2