Extracted

• • Target
    Project_Documents_pdf.js
  • Size 534KB
  • SHA256 5f74281b9f4ed6ee2b8594840e91b487f01845f756e3afca1d1302f1c71c505f
  • MD5 599679ab47eb635e68cc0bf801629891
  • SHA1 a0ac41a9231b9832d9ed55155fe88d9414a9ed56
  • SHA512 4cbd080169a4737f6baef15bd55bf07e26d067ca9a1a12bc891cb4f9b92842545b2df64721ca77a7399db24c65b246697012efcf0be416af98b8b5d367d513dd
  • SSDEEP 1536:o8F1YLG357QY4DsmEaiL1uVcqNtgBTWBgLxl3e1E7Y64PJZ4jQk4b5/q0LN27457:DcmMBgdl3lP4hZxckO2uxQ9uo
  • TLSH
    T128C48B5603450BBDF78D4EC5896E241B24F2E866BD241258EFB36AE7BC3FD849430639
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2