Extracted

• • Target
    SWIFT #53668 PDF.JS
  • Size 3.5MB
  • SHA256 4c5b6eba9a27dc52d3977d89726e3bf5d6b3bec56906aa5cb54837304b116b4b
  • MD5 179163f00f09fd50f60e2b4342960c4f
  • SHA1 0557ef72b36012f957d1fae5be08dcb6a8e47c4e
  • SHA512 f67ca3142ae02f4b4ef13cb4c21bfc93652ec19e9aee308d141a73162ec78f040116d51bf9cde12c55948595856babef532c9a87ac1d2c1e1ad52f803c56d1ab
  • SSDEEP 98304:a/KLLhdX8pXBD6obHzXr1YwmCVGMHW3/IfPwbKgs:ayHsxBu0HP1Ywmt9Ays
  • TLSH
    T1DB06171187187471112ED32DE933EE5C5A4E640324ACDF1C766D2A38B667E27AB8C6F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2