Extracted

• • Target

    Inv240521# PTYR (BC24-05) BL COPY_PDF.exe

  • Size

    1009KB

  • MD5

    9b450594b985d865f7fd3043a14b7b8e

  • SHA1

    69888184c00ddcae7b6a13e97bd91f8bf879922b

  • SHA256

    4de7625d54b60786d2e5fb6aa9d8401a6341534907dbbf5349150d0a1d5027a5

  • SHA512

    5d344da7a60c3de08b09f0ae7192b8711ed0f89f68d254e9eb0597c8ee4e41f1431278067a85f7ad82b67c8bdbaab20c93598e8884e0ae90f94569aba199589d

  • SSDEEP

    24576:EAHnh+eWsN3skA4RV1Hom2KXMmHaZxjx1iT5:Th+ZkldoPK8YaZY

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2