Extracted

Extracted

• • Target
    245087609-050738-sanlccjavap0003-1240_pdf .exe
  • Size 316KB
  • SHA256 ccba87531045163339ce7b8783011fc425a0ec99c30013061084c32ccf2196b0
  • MD5 f1a2417ec16678f760aa9a44724d273a
  • SHA1 f556a8a7d6037cbebb44c6a3391e09614e597625
  • SHA512 f8d1354ab818004fdcf7184e1329c650bb8448805dc6900abc7fa0bdb6edfef88f741381dfaf8b91fe066ced218e01eff452dd224363f7f63003463f1c33ccec
  • SSDEEP 6144:CEPl38nBIXft40x/hs0gOGkbk8WKiIRs:rXbswb1WKw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2