Extracted

• • Target

    Quotation_request_WZ_24.exe

  • Size

    1.1MB

  • MD5

    ecea73fa26da4f196457d02c6644bbc8

  • SHA1

    b555528fa1024c4ed0f32bd17278b82f7be9c45e

  • SHA256

    e0cc617ae8f5150690bd49436f8983fe753eb8cf41dc14624eae48ef75aac274

  • SHA512

    8a58ed595e0a323365a7693858b33bd17d304713e07c2b9a760e6c54430a93d758226497d7dd527466fa5614b3f8e10d76074fdf46d092949ee66d021157ea0f

  • SSDEEP

    24576:c4lavt0LkLL9IMixoEgeaSqW1bmstNyJHBq9MmCS:rkwkn9IMHeaSB1RtNkaPCS

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops file in Drivers directory

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2