Extracted

• • Target
    44130220531MES_S Quote.exe
  • Size 706KB
  • SHA256 fe2ae83c4440daa77bdb1c5951efe680fe1a2e41209ebeba1ae72792d9c9ae06
  • MD5 8dad659092ab3b70a72c6cc7e444d8c0
  • SHA1 c21c35db18ee40d5940c4d54df0b1ffacd1fdd62
  • SHA512 32816ffa0ce76e6f69d83e6f966a2379431607c29865c130f010afc23cfcd4593abed0481aba6a3eed4156904faa3c6f330c8a9783fbcd6dcc8cac9925924602
  • SSDEEP 12288:zpPy+rTlITNVkHzwiv3lAdXFMCTro+APThTUjVwdxb+FOKFSFlSP:zpPRrm3kHLv3mdFMCTro+APO4xiOK0l
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2