Extracted

• • Target

    PdF-Employee Payroll Contract Amendment June 2024.exe

  • Size

    679KB

  • MD5

    6f26c53438d1a4b138554599e3f196be

  • SHA1

    77f09f81a4109a5c1948013176f4756635821755

  • SHA256

    6bd4b1ca02bedf3c4d3fc74483a1c362cfc8830ed62b47333b344b43868850eb

  • SHA512

    561abea082ceb7029bb2f0cd78c0efd241061c835bdb9f9d23d0af8c6911b7232bc0fa54960a6b33314c4d1505b18e2e3aeeb8b34190a08a0678e09446cb4986

  • SSDEEP

    12288:O9E2iNStcYR0WNBpy0dZSDxDo45KVRsTgLasg+6KLSLH9nSEv+TmlXrVpnj2EAPf:O9E1McGhNvy71c4OsEE+6zLhS1w3U

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1