Extracted

Extracted

• • Target

    Purchase Order 6270-23_pdf .exe

  • Size

    15KB

  • MD5

    60e1ecc53db5a5cf58a5e6477c7eaf71

  • SHA1

    fca28e1db36972b593fc75eda58b2303d93a593f

  • SHA256

    abf0150e24ee2bb8ce9ae1e37bf02e88ffd32792e763b64167bb7e3c7f218832

  • SHA512

    e7b8faad12d8b9f598fbe57f2986dfd38533e54c7a797bb0e80b379d92b772cf279d50b9315613e9a5c46a502d101406c32f6045cfc1ddc1d631e0250212cbd4

  • SSDEEP

    192:LXao+tHEC41D8e3P6ktDOp+4FmIWfM4Wl:NGkZtNtDcPvWfM4W

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2