Extracted

Extracted

• • Target

    New Order pdf.exe

  • Size

    735KB

  • MD5

    4d0215e757c2b16805e0fd3f02153cfa

  • SHA1

    fa61b227f524932a613396437f28c11e27706da4

  • SHA256

    df22c622ece919c5d8118064a40dcb4b13b998333efa50a2727332a08f6de592

  • SHA512

    756e349e33d89baaad357f910835634a401b540a3ade3eb2a604cc0978d508a0496d12382a988e1e6cd9c535e6996d0647dd6c6fb4d2efe2090066af0277c456

  • SSDEEP

    12288:hpplJI5OCf9pYFrXhkTxGYMPOkKNOAKRiLyiaQBq+MnGY5fY0PtqwnYQIbwNWjJ+:hX45FA3KUzPOkH3iLi7nf5w0AvbbJ

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2