Extracted

• • Target
    RFQ TRQ22-06-20200051_pdf.exe
  • Size 315KB
  • SHA256 d69aa1932b2e702e5065ee19da9fc9cf2b05e7dbaa617141b14eaa501a14955e
  • MD5 154aa4440eee43b6472416eeb938f9e8
  • SHA1 643b61955b6743f33db01be7ecf93463fd887da1
  • SHA512 2a225d7128166394a26e226febd275f1ca1dead61666136008ff843b4a21eb0bf16a5b66c055a2d213d272d63c940d2cce02270475c9bb2551135a58cff77020
  • MD5 SHA1 SHA512

  Score

  10^/10

  spywarekeyloggertrojanstealeragentteslaratremcos

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2