Extracted

Extracted

• • Target

    Urgent Request for Price Quotation.exe

  • Size

    658KB

  • MD5

    6b6ef935d78cc58252420afaac8cd3dd

  • SHA1

    e204d7538c2d11650fdbbe7317c8d2c60091df8b

  • SHA256

    d22ba564b79465fff584d41655b8bd84e6bf0046b30d371cc2ccc5adc08e5a84

  • SHA512

    d6e1f68a2080c01c4114dab2e046b754e6cbb672261074479d44e368ccb07fedff8009a964c9ed270281b9c6b2acd9180bbd2251661d0c229d40834aa6753b7f

  • SSDEEP

    12288:PPDzsiDHT4Lo575PEadgBmrvsLkAEtpQoQv+RAy9vxiSv:PPDDi475YMvIfEtpQRv+RNN

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2