Extracted

• • Target

    Doc1507161RFQ.exe

  • Size

    28KB

  • MD5

    b96e3b103aa07bd9348f3d5d265b15ab

  • SHA1

    710b1bbbc832ee1941d0c8ed720a9876ad3e0ffd

  • SHA256

    71720ec77fe5f1bf93446abc71b1ae23da1e5bff3d45ca6eb0d52e8739e4a155

  • SHA512

    619ce6991a5fbad06447d8b01a6d31062c4d8da790e550f32957955adce4d965bb4321d70d5400876733c952b1ad1975b4a38a0c1a68ff538f0991b1c7abfcac

  • SSDEEP

    192:DQnIue9/6LKH75zAf8+yG2WWaP0xaZ/mhhhhhhyixp6Xw+Cp2qkFt5:MIP9yLm5zt+Cfasxc+hhhhhht5+pR

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2