Extracted

• • Target

    enquiry.exe

  • Size

    735KB

  • MD5

    752c73f34aed5a0e613e46569d7f1e63

  • SHA1

    bfd8a1b7d1cdadd45ca7c63cd3de9568dec701b5

  • SHA256

    496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2

  • SHA512

    0b16fc7ab05014142de060a26aee236f9ba34aae4dec9d5962d6ae544eff361c8561f8d8283ce40bef16c72b778b736dc595eabc461332015f06f4de1c48e7d0

  • SSDEEP

    12288:PadsFtzWYwqiZvwcynamw1Ry3fFKqcw+x8BmEjODCwlHcozjWl6:FzWNqiZ4cytw1otKRwkWxOnX2l

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2