Extracted

Extracted

• • Target
    RFQ-773463738342337833748334.exe
  • Size 1.8MB
  • SHA256 d6c0abd10f0fdda2bc4853cda6248a75f6b9c4a21de781b18be66519e124fb56
  • MD5 4913f862967c91cdd81223517a75a096
  • SHA1 568bcbaaab18964aeca3135588db57a3eb77a03e
  • SHA512 4a4caebebee4a0230490b3a1c5e7b2188940a32e9ae5ec0001cf093f49aa568f63d0abd0aab811da2f0a5e5cafba1998f8f0facbe73ae0fd97bbfda0fbd00f5d
  • SSDEEP 12288:0qnVFaqP9D/Lb3lXf2IGAlCYg0Eyg2mMG+FCEw2Hpd2rC6jkku8AQg2QMFi:0qvagDvdfdl40EyYMZhrJqo04
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaevasionexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    RFQ_000000000000034094.exe
  • Size 2.4MB
  • SHA256 17c1e3264bcf1251cdeab3744cb8ae56b27c816e9e619f0ad70e5ef7a2102fee
  • MD5 1b32eeba7e8c40405ad153fb23fccf03
  • SHA1 4e09146acbc01bb953d3467e71c4ed7465e722c6
  • SHA512 0c1f6d48819d523761d170fbabb33693cc2aba3cfa8cadbf692f91761344e882bb940a9e4ee4c2fe259cfd3f77aba099c92e600a5bcef69aeec892d3b70ba418
  • SSDEEP 24576:mD0OYUEyJM/UUYq9OJCqYyJ6wkBXZsYemohujcbNppFVI:mDzYUDGsU39YLxgho0cZphI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  remcosremotehostcollectionevasionexecutionrattrojan

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Windows security modification

    evasiontrojan

  • Accesses Microsoft Outlook accounts

    collection

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral3behavioral4