Extracted

• • Target

    Shipping Docs.rdf.exe

  • Size

    725KB

  • MD5

    f2bcf5a8f702dfe1879495f5428d2c2a

  • SHA1

    47ce34d0266e5d0b2a884d1e53ee8099124eb3d7

  • SHA256

    d7f670f5225888ddb631d26ccdb01a8c514965d48e15f3913348db8949b606fc

  • SHA512

    c8a8c2293927b97c33599f77d343f2b91c31f814790e7ff4891998ebdf12a149ab33a7e44b471043abdf1f38e9386f6e30a1adcebcca4e5f51ef328b3773b128

  • SSDEEP

    12288:qYE8BkorZInC3yGs1X1UmaSudfjMmxdB/L+6Jhwd/SHGkR:BE8BT9Eusp1UmaS8oCBMQHd

  Score

  10^/10

  agentteslaexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2