Extracted

• • Target
    ONE_GZ_USD_Invoice_Verification_12345678901234567890_BL123456789_USD25000.00_2026-09-08.pdf.exe
  • Size 1.0MB
  • SHA256 75da0bf66f46e65566f18b468fe3b747b371fb854bf2fedc0b6c77ad3984dafa
  • MD5 935335798cef23f623dbe580998e950f
  • SHA1 2ea7000b7ef204bdf1ad10180f0b7598d32a7e3a
  • SHA512 9c7b9133271b0b54776333a193cf14e5eb994f841b59b0032476b10f81dea1512f3ef8ec48a5c1ccc1a470fa29cb1106ff969f208085590cdb1247b5fd9cbd78
  • SSDEEP 24576:rWpq85CovDkC8I63hFeMhN0ZjxOzBhGGqSoJlGjG6TZ2J:rW35JQ3hFQZjxGhMl8Gi8
  • TLSH
    T1DC35DF946617DB37C46177B0CA73E2F402692E99E801D23F5AEA7EFB7F74E205910242
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2