Extracted

Extracted

• • Target
    rRFQ_251477800TM.exe
  • Size 699KB
  • SHA256 21b046d70a17b53ef0fe65babaf531affca080ff22a167f5c38393f6534a47d6
  • MD5 366185ae7ac91aff71406907ce654ece
  • SHA1 eb1f72636407ae0e855108f7309d9204ed17b0c1
  • SHA512 d7cf01b7900bfeb2e58b22e97203f3c793ff89dd87e49767f85296b0583faf15281bb4d90fd867b0ecb7d69da62e7f07ba07f0e668cc6ddecb28ee575141370b
  • SSDEEP 12288:3S3RAXYMjhvPie/rByY7777777777777B+28a7iWDSkUgxIqmf+eyPmPyAYNTuAi:C3RAXYMFniyykL8+Ag2p+N6tUD8B0uHT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2