Extracted

• • Target

    PI.exe

  • Size

    679KB

  • MD5

    44abd1f0c74471d61528aaf0bcdfe7ca

  • SHA1

    e05ba2523bdcbf9fc6753b6ecc7996ed1b5d19df

  • SHA256

    60751e1f86b4b78e592917168a731a30b464a6c52b59118490ac8411905cbcc3

  • SHA512

    976abd99bac3e04846c84f057b27365f6c8ccc342fc256e205665c0b9a585fcff1f1b636ec0df0386f1057fb44fc039ec25a7e63f03ff3876b97d78f4055fe12

  • SSDEEP

    12288:CI1xIo03/sYe3FAckjc6ssEBfFD0sxwHVOWee99zKYhGvOHH8gg26N/SbSQvdSDz:lkA6dEhFgP1Oq9zXrcgg4SQvdgV

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2