Extracted

• • Target

    Outstanding Payments 2023 #00432.PDF.exe

  • Size

    945KB

  • MD5

    d5b180d22bd1d7e49f616e5b8cfdd0b3

  • SHA1

    402be951165501853fb889cf34767a3b9abfcd69

  • SHA256

    8f097644a59a8d6e788d527323bc56ab9b3cc13fdc8e3173bd9ceccb8bad031d

  • SHA512

    d44a2885f17c11b121245bb9428c2988143cabe0e265695a19a49425a141ffaee3af0dcbdae813b41a54be12b6e926cfaba6b3199df5bcee2a8f13189f27f67a

  • SSDEEP

    12288:KU6wmXUVUwg1dAGYWnE7qQIFZhlcOOdPqDQQgT2xtwN3UHAXRHz:J21dJJQIjh2OOdPqDQbT0wuaF

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2