Extracted

• • Target

    Quotation-099847664.exe

  • Size

    609KB

  • MD5

    73cdf6d4b27c70e137e6ef2e146e4758

  • SHA1

    e7673f5de0b3cc9d8eae0558f6bf26fd38c08bb1

  • SHA256

    d2de362d6ccc7d4009ab97039f678c618e7ea8a30c856945b26b47cc289f8207

  • SHA512

    b4e795c851fbed8aa0b9b3a77cc64d3c6921438d1b06065e16688e4654f0968eb9edf675ef98769c7894263e9a49a0d515b8025190e7eee922c7c37ff3fe9250

  • SSDEEP

    12288:ABZytQs2AY2VOEshl7Fi7MRUJQOhw1/g3YwkEY5UI:cZyAAY2VOEyAdJQl6shUI

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2