Extracted

• • Target

    CWXMF230300599.pdf.exe

  • Size

    988KB

  • MD5

    06d1f96907c8265da37dfd9dcce3bff3

  • SHA1

    df6e90bc4534b80433b045ba767d62d3f170ae6e

  • SHA256

    1934c9d93e6a4198e68757441c611e6c31306b38aeec33a5f1f6c09f1f8ce466

  • SHA512

    3b7562f2a03037ce2b4c3fdf5f5391ba8036697939d336f9b23a835d717297397f32e65815cfb55c949822012200cdd89a7ea95db6269488eb391b0911917aa8

  • SSDEEP

    12288:OWoCRCrFF1HvV7J9BEMF/UTpUMCyrxLxoWMLI8N2RMXmPqpYyEiGen55bQ+k9iFs:BoCRC77J9tGtWINag

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2