Extracted

Extracted

• • Target
    NEW INQUIRY.exe
  • Size 739KB
  • SHA256 a3028abb8f14d32babfc33852545775c77557ebd1eac0f119f44dafebf4fca07
  • MD5 8c43124c8f24e725cc9bc17fcbdb1a8c
  • SHA1 490525034d262a0dff39ffdf22f2345d10090821
  • SHA512 00e9c5f022e8783bda556270a6a4b4c42c68e7c73601acd26cf7a7b7a3c504aa30d2516795005e0ae4cf45cfea9ab814417eb7952f8e0c9b4081f90251448f36
  • SSDEEP 12288:rgsqOr6pkaiqyJMOZfc6oc8iAr6MiLBFkoNae+d/9dCRXK5WoWbfa+Y6dnfNez3W:05Od+c8iAr1Ab8eEWov61WlwEbnUz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2