Extracted

• • Target

    Urgent New Inquiry RFQ_Pdf.bat

  • Size

    1017KB

  • MD5

    38d8ff52d35e7fab1fa3a10413e11570

  • SHA1

    3de93044807a42c01ff9030c3dc3381bea6dd643

  • SHA256

    1820201900ef3644a747983b322ca8c63c48362a4e9590b719ec824e5930f642

  • SHA512

    19f3ce4203e679cf65ad8df86dd2344b3b83603a6c6c1411f715386cdbc236bbea6f5c5f4f87de7f7cb438f4eee601506649bb8abb7bc6c2ba30efd74c1b31d3

  • SSDEEP

    24576:zCNjF5S1Hvjspl5HEUe0Ek0DUMLDFFS7K03pWlWIyJQL:GNuvBWgHoW0If

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2