Extracted

• • Target

    Comprobante de pago.pdf.exe

  • Size

    2.2MB

  • MD5

    4975e77aa7db89e438da054870282656

  • SHA1

    01c131d5d3d87470b6c74673f310bf742b0b1cdf

  • SHA256

    16362b718dada80d2e68e3495d78e32fc5bfa05d730ec1a451daf6cff9e6cabe

  • SHA512

    93f214fb28ebaa4ac45141401e6d29f401f062087fa81eb0a494527e3ae0d66ea0daff6022f89b6f8881e295279f2c5c2fb84a322e3108f62f2aac3ae59d8ff6

  • SSDEEP

    49152:HX3ASbdYAm4zEbdYAm4zWbdYAm4z23Ag3AWbdYAm4zSbdYAm4zO3AGyhdWn:HnA4drWdr0drkASA0dr4dr8AGi

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2