Extracted

• • Target
    Swift Bildirimi 10000.pdf.exe
  • Size 623KB
  • SHA256 18ab014eb02b94eef74b9c6fd3f84a8e9c593d9cd8deca6fc5d50adb723dcc83
  • MD5 9dcc954d112ba99e061519fdae504600
  • SHA1 75b5c1782b991c9e0e9fb2bcd5f04832c9ac8d43
  • SHA512 5d057cf4e35224ecaa234b80b9dd3063ac1de4bdde3824e6d2fce0eaa6df0a63f004d10d1bf2eb5a15660ceed324071b81dcf37996826270bfe221a554d2a4a5
  • SSDEEP 12288:xVXo+qA8w3vxteLzTdyvcOTdBKBIU2CazOPgz5M2rvCCGR6n4sh6xc/G2s:Xl8w/7pTk2CgOs22rKVM6u/G2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2