Extracted

• • Target
    SWIFT USD 202073132254113.pdf.JS
  • Size 3.2MB
  • SHA256 2bca559c429b22aceb5a4eef5fa8db4b3655cb860d9722dfe3cc873afe45aab9
  • MD5 20b2004faff89474a47a1ca0b6b3da25
  • SHA1 c1a060c65a67f93c6e0f7ea1fb28b0387b2f7cb5
  • SHA512 37f108ea02981d4202d8340ba1fdefb57f48b5a91dbf3f8c78f3d3f0aef634375303decdfb4a55e0b49401cf868c441a8efd0b558962ddcc9b28a57440eac3d2
  • SSDEEP 98304:XwPQn8mEFAGz6qt9QCgbBCeQoOrW58B0cdtHH25fxSi+lGAScrTd5lLeoG:Xwc8xFAK6ZNbBCFoOSKBBJH4JSfBTdvg
  • TLSH
    T10CF5B25413899132B73DA79C933AFA30D50A961316C6DB1630BCE2087B7CD0BE759AE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2