Extracted

• • Target
    SWIFT_Almanara_Overdue_SOA#384010-1CIF_DXB.pdf.JS
  • Size 4.0MB
  • SHA256 3b5a15eeafefa6f141adc282fdb0839578e6dd56614934b4e21dc04f421f54fd
  • MD5 e428a948731bd4d539bae397a8b5c196
  • SHA1 a4fd5f46febfa534d3b3ee52623ca5bdd5b81fde
  • SHA512 57f105c91856065666e12e518fab9db8a646a47b692095548fa70ad72841088c8f7cd24dc1400bee484bd18f39f6b80b2e1755e140e3816792ca4822b02cf8b6
  • SSDEEP 98304:SbjuSscuwkhEt9MTO24xSFieBNpIOPKmlaRSzuKQEwIkleHikLX9DmLpINimchkU:SXuSscuwkhEt9MTORxSFPVIOi4aR/KQB
  • TLSH
    T16C16604817C1D531B324F74DA93F8DE2F48A599325C2FBC2302DA9143B689475BDABE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2