Extracted

• • Target

    Quotation.exe

  • Size

    696KB

  • MD5

    4f1e4c96e3a5555a2c22f145df3894e8

  • SHA1

    2936fd5ee84724b1e8956985c95b6b5b0cbfde68

  • SHA256

    a020a465557525b5d64fefc01a74348e5c8e5bbbbe2c01a8b99da32b1cd931d4

  • SHA512

    9dc8fdbdff6c9d7d9dd19aee84c72edc1f64449088cd217822b7a9b510f62f8e17d2aeca5a181799b75c4fb1131ead9f04a132daf0596c44fa5fc57c5e4ffd8a

  • SSDEEP

    12288:p5F6HkkoFlJTQVqywuLPpzYrsomb3QrUGMRm68sqGgNCp7G1PwQsbagVLu/:p+uJTQzwoxsxDU//xqGUCp7G1PhM

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2