Extracted

• • Target

    p silp AI240190.pdf.exe

  • Size

    748KB

  • MD5

    02c468dab798e0e6bab01d840656a82b

  • SHA1

    ded241846767c42dcfe3b77817d95794c12d45ce

  • SHA256

    71f24d2bdc7bc70947a17e6eaf6550333244ad8cc1e604be8640980ea031b507

  • SHA512

    e40340e26b76869908da6ea82249d944a329d0c690d7c041d825c2bb1372542636eb2235438cfb1bb3508e118fbda6660cdec5fc0854c4010cb5dfa81fba5881

  • SSDEEP

    12288:ZQK/pbM4RwwAbS4uUvLHE6xdBMKvBedHae1kRupQqhQz67H/SVYT:ZQiM4iS4uUvvf/EHaFRq7fSVYT

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2