Extracted

• • Target
    IMG-Scanned_May-2023 RFQ POs# PSP#-1839.exe
  • Size 493KB
  • SHA256 be2e502741ec2c35a2e681b330437fab4b2be5c44a81047db43aa669152c2fc4
  • MD5 8a8d3b11073892589428c936bbbf350e
  • SHA1 03b81f24fbdcfe75fe7eea7f1f6323d267d05107
  • SHA512 65cdb381b4c9747a37668cc8d1267da9d711b45d76d1d6acc7950e3d657dc142cf0527ca7003ae303f3cf85aa7eb5804e5a96988bd83e041472883929ba20d88
  • SSDEEP 12288:OZfzc86Xg4Tta9rhnrWTA/VjnTRq9sctUvXgc+jff:O9l6whrWWVHWUIH
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2