Extracted

• • Target
    Shipping_Document_02_QINGDAO_ZBD.pdf.exe
  • Size 941KB
  • SHA256 a9daa946ff08e4038a183f4af6a23b770a23ed9147d02a5105483a517b075de5
  • MD5 9a25d6a22155cd7d35b43e7395786c94
  • SHA1 d3bb25ff6774e40decff40e3c5b4c14f6df1e8bf
  • SHA512 eddf5768a37fb179a3f8527a9f7d4a75db1660701032dbfaf3e5130fdaa2b17810ea35bd150627965345c33c9148cd1be700b8551e2d0e583681eb6ed6000265
  • SSDEEP 24576:HJF+2svYLYFhQI4WxbxjR6uy8aWVFI/MmEp2OF9c:HvPJLWzHR6EqYp2O4
  • TLSH
    T19525CF9C3254F58FC817CE768AA0ED74A6206CAA5707D30391E72DABBD0D687DE141E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2