Extracted

• • Target

    Order RFQ22092020.exe

  • Size

    1.3MB

  • MD5

    70d3ccca1f07cbe2253bfd8556c201b9

  • SHA1

    17c40935843556a51a5b170a0ddf6e3c53e8cde1

  • SHA256

    f45bcc09ed89f725b30224e84820e605e5626c3e6777d433f4fcd56419f0012e

  • SHA512

    a083e58ec2df2157fc5b0d78d2efe22840cccf3e70c9736ffbc235ba89a4c6cf8db598f0cf09ecb5336af951fc9cd12290e0595e33fe2ab831aed676f239641f

  • SSDEEP

    24576:/AHnh+eWsN3skA4RV1Hom2KXMmHaVGCl5Pe0dMpg3ulr+Q+xQ1uH5:ih+ZkldoPK8YaVvo0dNQDf1i

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2