Extracted

• • Target
    Enlisteditemsforrfq.doc
  • Size 377KB
  • SHA256 82d32071833bc82e3d60a9904678a1ae49745d4f3cdda64e6d45355ae17bd59f
  • MD5 7f470188e082999af3100698c29698d4
  • SHA1 aaf49a597af6de072bb5c12c589807396409d699
  • SHA512 a77177c28a96bd8ac51826ab4847c397709723c2dc2cdb6d32eee32914690171637be444bf956bf1f833c6c1a59c33dd80068d590145e6f234c0924e9419545e
  • SSDEEP 6144:nwAYwAYwAYwAYwAYwAYwAYwAYwAYwAB/ggqY4:f
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2