Extracted

• • Target

    18092024 PDF.exe

  • Size

    849KB

  • MD5

    7e7122557d4dcc0e0e39031aeee97570

  • SHA1

    ca1d7c0bd2ae735caa8df2ec50f6afec92b6e565

  • SHA256

    4753f11e296430bb40e328ad38fe44ecf72aafcdf12cfed22bf16d3f8a0ade34

  • SHA512

    4f74b2fa8f3b6b229c6b3f8c415536452a0501d1d3cda0fe77a9a3e9dde5ee41db44e072c584b9f8f2336b3214cde1a7a6e7d0dff9138212d16ae3aebd4fcf8e

  • SSDEEP

    12288:SKlllZcsZ6ahn6JZN08J734IAMdv2+p8HVzzuS+Q3czbWbtb+Ayt+1LmZ3K1K:DcmN6Jj0ibXv2+WD+Qeb0YAO+1W3K1K

  Score

  10^/10

  agentteslacredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2