Extracted

Extracted

• • Target

    RFQ# 33257 QUOTE 2page.exe

  • Size

    373KB

  • MD5

    b004b56de5deafd9a7aa3d5797351433

  • SHA1

    110e1cc5237cb7988d40a1f64268238b5f0f2b2e

  • SHA256

    80823066c678eb73f3b02c6da7335a2f911968da9315aa2db86e01bb01c50f92

  • SHA512

    3e3a44e62deec3ad25e6d20abbd9f6f9f4a16d224b6dc10ebef6ea05b9806967f47e17573cc8f93fbe1ac7e0c8af744a8a4d7d3ed1aad876774a463ab6c4d41c

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    RFQ# 33257 QUOTE.exe

  • Size

    286KB

  • MD5

    8f7b7cf4cf5a95ac404d9f7e047293a2

  • SHA1

    127013ff55defc437b41bc8442e7d2bb45c17f3b

  • SHA256

    313519528c86c1ebd08c03ccc3a9640dcf4861c08313c89004113ee802568003

  • SHA512

    4a76a8ba6b570f2857a145bad79812b739c5bba508bf16c206437d7bdca9ba1039d820683d144f2a23cef4347c276b4c00309f0b67f66ad2fc485cd5273d30c9

  Score

  10^/10

  nanocoreevasionkeyloggerpersistencespywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral3behavioral4