Extracted

• • Target

    INQUIRY.exe

  • Size

    987KB

  • MD5

    e5265906364b50b3c76474eccb791319

  • SHA1

    c4d7fb4ca637a7853e32d2dca8bb8f1ee953e8ad

  • SHA256

    92d2a5ac1445f1cf95317d89b5b1649246b56e328894b584523e690def1bc570

  • SHA512

    523c0c312512bd2d38e5388b8898d1b9b04fa7aa72ee1d4f311ea4b4c2f53678c4a03d8df3db6564228a720a00e996d41b63624bd51cd14f9d2e5679aa6a1c75

  • SSDEEP

    12288:kgqC2J6e2bju7kXl9FWg3qzwzFL8O+TpGxzjUR56J2apsADqjJ5nGmwl9cffomoe:kg52sfikVSkq67tXK5SWjrGXu

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2