Extracted

• • Target

    URGENT REQUEST FOR QUOTATION.exe

  • Size

    694KB

  • MD5

    47cfd7df0907f049cb95d36e82e2a60b

  • SHA1

    97ccc9a37ca3c281f6d15e45b393a831109c8caa

  • SHA256

    15d92d97b0d9181ef3a9270baa8d36b15f6e5c61a8c26ebceffcb3af2d06b527

  • SHA512

    4621674c28eb6cd86d24727a4aef42ff93bbd9012eea899f726e60acbffc51f97bb3d95ed91d40fda57ab9951a499ce92ecce9d99d0007e5b4ac08eb27652537

  • SSDEEP

    12288:AJJ4NOlWlrfYer1AAMJ8soKIt8MKjtEsnab0VA0OGX7ZcGHWhjm5kR:AaEldJ8zK3MKpEsnab0VTOGX7RH+jmk

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2