Extracted

• • Target

    INV01562.pdf.exe

  • Size

    997KB

  • MD5

    68903a58dc8c61f5b9c13ddf753be9d5

  • SHA1

    1f91c9345407ec20fe08243ffea1db32c8d7fb27

  • SHA256

    6d033582691fbfed1308554793024626bcc07d07e904aca0d26f93f2a083893d

  • SHA512

    00deaad5b6265600c733547f83c58bf668db884656aff28af6a4dcc671fa5764d568551bcc3e37970d132374488163f9dcb4b3eb30f621e6836e6cb7c41a7536

  • SSDEEP

    12288:ADZ08bolxtBHkQMGKx58qTt5MpfMBARLd5h15sHogdEkBPbQpqJ/d2TU0:TtmsKxgpfMCRR5h15sIg6kBPYQP0

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2