Extracted

• • Target

    TH PG FORM E DRAFT FOR CEI2303125.pdf.exe

  • Size

    781KB

  • MD5

    06c8b7f78dba2ae3b809e9421cc0fbd7

  • SHA1

    e2d34f41f171ca76f98bbe71aaa19e8233becfba

  • SHA256

    26286ef181ca7f744d73b6922aadd24bf521de09e9fd149df088247314447075

  • SHA512

    cece0c4fa19d551ce2ffebb3d1f023ca514c81c8d2de31b317693fbfdaadfe6b66c90f9eae7089c27328279817f96ebc0833676f3977e9490192f3d7d078affc

  • SSDEEP

    12288:2Qc+UwZMMMDMMMcCUipLesc/79XsnwbYIKkKSzX3JPY2iuNmkov3fY+1:XLMMMDMMMcCFesM8nwbPKkDHv4BvvYu

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2