Extracted

• • Target
    Order Requirement_6000025581-Pdf.com.exe
  • Size 897KB
  • SHA256 321bcda7d38de0888c3bfe28e8f3488689ea9a7005645739a59cf5c66a72d00a
  • MD5 ff48431eb8f8aae5c1c2218c2221e134
  • SHA1 f41004a9345f1bfb502657830d1015a5b14af1fe
  • SHA512 3770ed57f01e6d5f458017584902c8842f3f389ed67ddd3dc7ea4563bc13f0b54a202d29d452fe7c94d459901e1a78401292247d21dc5f4d4693dbbf697b7900
  • SSDEEP 12288:7JEP78/2iNJLjQSdpbD/sI8wqN4qCXb2ut1qUcRIjAPRG6w9zIzLO+P82JLgH:NEP78/1rFfsIeN4qCXb27npGT0zLEcL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2