Extracted

• • Target

    QDGS140625 Format BL.exe

  • Size

    450KB

  • MD5

    1f5fc6b5705f02547b22f321de7e246c

  • SHA1

    5145b4acd60311d02630d0981c23699485ec58d0

  • SHA256

    f267d7b1aaf24adf016af932c069abebf8789bf864b56c9b9e81d51d8c3d23c2

  • SHA512

    58af42103606c48b67f55ebb2f70c66c0d2d2f25556aa118b657635bdcec2b22c7784e8ea4386074afa147fa7bd7fe94aae680e3c78e3ed5c1eae0d4b050ad68

  • SSDEEP

    12288:9dxin6lAe0wOqK7tWzWlJ+lhJOED0UkT8n1TxAf:3Y6lU7qCbJ+lWUn1TCf

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2