Extracted

• • Target

    ΤΙΜΟΛΟΓΙΟ Doc_PRG211003417144356060.PDF.exe

  • Size

    617KB

  • MD5

    77e2a7eff380e6b378443b71247204b3

  • SHA1

    45150f01da24eb9bb7083470c15fbf92dccafb7f

  • SHA256

    a8f4efff89b74b63c720cff52221a7e62dc648ac40d3b2f5ab271a1e5d78b7ab

  • SHA512

    e86b836904623a77f73e52484e18a7570a16d53212dfc4f473ac5f5bf1cdefb29a32fa35496737de56143024de6e3f26c4c60a77614cfd4e9e8f1f820d34aa24

  • SSDEEP

    12288:6sHzOUNUSB/o5LsI1uwajJ5yvv1l2kNtPmB/EaR/GrYjQ6v0Uw:tiUmSB/o5d1ubcv9GlkrYsH/

  Score

  10^/10

  discoveryupxagentteslacredential_accesskeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2