Extracted

• • Target

    QUOTATION_JULQTRA071244úPDF.scr.exe

  • Size

    390KB

  • MD5

    6d45f82383d6da5ca15af6d8b6ddb412

  • SHA1

    30e3d33eca039badc0b2add6b5599199d311745b

  • SHA256

    d09cae82231e8bb39eb676c09e80c9ad8ee44e2cb6dc0ed505e3a3855efeb400

  • SHA512

    67d45d5bb8d6a861a2ad1efc8b184cb56ba722baf89a48b8ab0b896dfcdb5f9910ed359c4afe94794b111eb26babb7ebb12e2a68ede41c95180c46f045ead421

  • SSDEEP

    1536:pMhZVC0FEvOUx59vYTGP6mrql/NhuCtG9Q7qPpqOLy0uyL+fR:pMhqv9vYTGPDOx6H+Yuy0

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2