Extracted

• • Target
    p silp AI240190.pdf.exe
  • Size 336KB
  • SHA256 96917cf7bd76b25e67d9c71c36c8b3055fc8232bd7e522eff573e02011a7bc97
  • MD5 9c251bb5726be9313f2487ef39b93253
  • SHA1 bc30cc8ed2f9dd993917f3ba6f089783b01cf8ad
  • SHA512 a6ef1b0d3023a3d4965bedf5610aa2e443db422264d5e17da6129c8b407370f0cd8de65b47a849448ef8f7096c402e124b63183fc48a078ff15c5d737689d360
  • SSDEEP 6144:Ozovoe3sqxBJY1yKDcd1XromQrPzna35y5Yvca1:Ozt1qS9YdkupWYv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2