Extracted

• • Target

    PDA FILE.XLx.exe

  • Size

    895KB

  • MD5

    2cbafb80de0fd64a4279a40c9a4bf3e2

  • SHA1

    dc7491fd3fc764461ceb813279d148a288ca1c5d

  • SHA256

    e6b297fc5effcaa65ed935f78e8b663257f447a9f569c4da0411854fe28a75e7

  • SHA512

    ddaf9d263df4d0a467bb3d004040f8dcc378fa79c9c74dd1b4b58772a22d89fa725538597f6d65ea84fa66cf079a87d2c2f31e7e730f29cafd2d46a8b0ebd79a

  • SSDEEP

    12288:kIcshsDwXOBwGn48dzKG04mkQ2arQCScqpLfODJQNdCIVfCDMwzAu:72dB14Uzu8Qt2ldGNQNdCIZEX

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2