Extracted

• • Target
    Latest_Credit_Note_For_Stamping.pdf.exe
  • Size 959KB
  • SHA256 fdc9cb253a2ebb99df48133a5c2e0d35cfa5fb4ee7578f6648bded8b5187b42c
  • MD5 afeb6d5fc91e7f54feb84544c13f086e
  • SHA1 c8fc8fdc508bfdbacced8192b229233f095e5771
  • SHA512 37a9c48b59053acca3e3f35c05f1529d3c17fef7db1f7572c5f4b6e43b8f643e9084666338cf2bab6a88d93abc29a07abe8c8adea6b4fad46c1057679641714e
  • SSDEEP 12288:5fwfqnOmSWvItUKEu8ODsZcvCkFtjV+KnFD+y12wwrN9WT/Rve/J/1SATMcmAOWy:5fwfKrISqsKoaDX12wwjWLRUSATMcY
  • TLSH
    T17F258D9C3111789EC927CD72CD646C74AB2068B6A31BD24395D30DDEBA0E696FF052E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2