Extracted

Extracted

• • Target

    BBVA__Aviso_de_Pago_pdf.pif.exe

  • Size

    46KB

  • MD5

    c34b58d960ea87eec970a9333c7f9292

  • SHA1

    ca23b1d2418edc91a2a49968738ce09a6f7bbfc6

  • SHA256

    8b3aa60f494833274c18171586730f2f4650a0c8c2de4cd901d853948b6f1fce

  • SHA512

    e1dc12741f2448059aeb99be1f6e0df91bb4ee655b3be892ecc027842e78c39b3388cb5748dbac8b56f8ad245312194159522619b26c6775f558b72245c64aab

  • SSDEEP

    768:LDpDj/nau11+B1Z9wg4MYVctOi3FaKMUXF1x2ySCtk7PHqAk:HpvnaK1+ZWg4MYVcAKMUX/x26qHVk

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2