Extracted

Extracted

• • Target
    Quote for Urgent Purchase Order_pdf.img.exe
  • Size 693KB
  • SHA256 bdf27a5c5327e39ec2d7b3a6a7c5068b68f0d0e46791c7afad0ecd6b1a803ef5
  • MD5 255888a3c4a506330ea337474c6e7359
  • SHA1 0d9ace40ea7f20239f4df694306ae9d85e6fb0cc
  • SHA512 e377d7665b832ec9497c7705fe6e0443c629b6a17e3005c4b176016a23e19621ee0db7583506ab62c1785935529540876c026121e821f563140156933b4a4c05
  • SSDEEP 12288:eazScVt/uoFrfWrR7gKQEtaJjAmRP4ocUxXNhGdwYdnqiOoOqFowmg:/zSOtPfWF7gKQMaJjAmWojGdLtOoOqWw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2