Extracted

• • Target

    CATALOG DESIGN SAMPLE.pdf.exe

  • Size

    893KB

  • MD5

    3bfaae0b4bea0b36968b40a08bdb0d85

  • SHA1

    d967799713af81d2cf41521bc83743527179ed17

  • SHA256

    0df26b825268eef7d7f14c5e4d01b554662033aaff921d055e35dccef79bd536

  • SHA512

    eeebf033b35b4a130d0bbaa300c4ab0b9700368716ef8cb144b2508112a6c15bcf4d7fcacbf7c4ce291aec1bcaeb01a60eb717d5cf3504cc8103134fb3430508

  • SSDEEP

    12288:wgIdCFdSZHZ/vEUsHWihc7Ax6zGGYvo9eHajD2O9RPxMza9PlfAwU0sOjVwAXCE5:XYYSZ5/vWW7WGYvYD7iulDTV5UETmbat

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojancollectionpersistence

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2