Extracted

Extracted

• • Target
    Pre-Alert_Documents_and_Debit_Note_预警文件及借项通知单.pdf.exe
  • Size 1.1MB
  • SHA256 6e085dc4297fc566c8749293f56dd6d81b764bda9f42ce1fc07af22ba8309444
  • MD5 c54a0857fe11672527a2343ad99a2468
  • SHA1 6b06fe78f692706767490ce72f20c70a786684b7
  • SHA512 e82cb0ee115996467c6e3547b6bcd36305c121bde6e3e6a14b8804883fa46d3e30f34369878a375aaa8407788d28c3fb76b71403c33a8f75c4cfcf1a81a71686
  • SSDEEP 24576:2sGqj0qdPBRkuRZOs/qNHemCdMcmtNk/YwT/XfS5OncZb7MPpOZrW:2SjRfRZOvFFCdbSU/v+24bIOZW
  • TLSH
    T1CD4501656723D402CA51933145E2F6B803B85F9AF413D31BAEE8BEDB7629F160D84783
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2