Extracted

• • Target
    PO#17971 for November 2026.exe
  • Size 1.0MB
  • SHA256 6f4facc2fa66e56e5fffd3d269218c28c48d956190fa8fa301b863157c66c282
  • MD5 b1235029b1fd5efeed08563866f87af0
  • SHA1 154d3e76521d23f58bbb907d4d808368673baad4
  • SHA512 6fe8e89b7d668bfe7e683b0b15a01fab42a5ceb8692c6a68a2a36a6d25a89a4671ce220135e3f67f1f153cf796796fd25fd37fd1d7a68027d5ce14d92aca15f8
  • SSDEEP 24576:NtOowMWXF9cmPpzN+ILPA3mjULPCqIH+YbGNF:Ut4A1N+oPA3mQDCqW3
  • TLSH
    T199358C983250F58FCA57CD76C964DDF4A6202CA6D30BD20391973DAFB93D692EE041E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2