Extracted

• • Target

    Overdue Account.pdf.exe

  • Size

    670KB

  • MD5

    81937e479c70381a7527b21693ab3e6c

  • SHA1

    fbac04ef1e0315bff71d908496309d731da30c75

  • SHA256

    e48b7b9ba50d500f569024126a2ff8981db13525ff378ea2151ce8d6b7e4e452

  • SHA512

    35b56dce2a110c145a4c4bef02a5e0151835ea1f1d64891e346f77bf3ce4a3cae2b81f098e819183a2f664f28997845a22b071805e76c97a009b2f6241bbaded

  • SSDEEP

    12288:PBB778QJ5RBdmrRwANBlJi/l/XbBzN5L/ObdOC0uCnGbmSAnJGXuY7GzkR:ZBDB0rqclJeNvL/EpV5bmJKu0

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2