Extracted

• • Target

    RFQ# 1000735894.exe

  • Size

    665KB

  • MD5

    c31d914451c7b7417d6dc961d9554307

  • SHA1

    9a6734273004e6fae64fbc46591ddf4253cc094e

  • SHA256

    5cd0843b990576cd296b0a64896c77d2fff223e6a5e223110f22ef810666dc93

  • SHA512

    8ac5dfe0e59023b8e82f05f02b0ce0dc41b510d0e2ede20bb24420ded826588cfe39b085326c20cf07db68e9acf65c25d95f541df583b62357bda6325bef45ec

  • SSDEEP

    12288:YZsBd3657p/8DL+hvxG20RjtU2bNC2+9ojgCAKpS2YQjbEJs4/QmmJgpS7wtO:MsBd36UOhvxG20RJU5V1CAqdYQjbGs46

  Score

  10^/10

  agentteslaevasionexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2