Extracted

• • Target

    Quote Parts & Drawings·PDF.scr.exe

  • Size

    1.3MB

  • MD5

    04197631610fcff89ac5432c6676ae65

  • SHA1

    3e30cf226464990416fbfcc0be65a468302267da

  • SHA256

    a10daa8a6ac61896097f0422b56230101e78d8dae64cc06f68823c1fdba96876

  • SHA512

    8108a9a9a9c399f86f607da86ff07df46ec31d98f26c9596989414815ab13e402977711bdaa4f2624aef17a1ba89cc2f4896ef81f33d2becc7d2509ac912e7a7

  • SSDEEP

    24576:oDnGI3jAnCYn+NFy/PVIvI3P8wGuG5TdcGg2fYzEcCe5h:oD33jTkUr4GgJ

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2