Extracted

• • Target

    PO For Quote No 228 for lab Furnitures.com

  • Size

    396KB

  • MD5

    c74ffae162c3a8af2dcd2d2f4d0fede0

  • SHA1

    6996ba2de525eaf627a8b4f78a7c7371d29e3b1b

  • SHA256

    b2059d59922556f2677361a44d5b1c0a4422654e1f8e1af8f311771c4cf818d2

  • SHA512

    9be2b36a97579bd569957dd4812419aca7c57eb2e61b3cc29cd6bb77a5cd158fd9ad11eb9dfe89a0e07be1ad45adf626133c37d100e11d72e1c9b5aaaa31e47b

  • SSDEEP

    6144:5la+LP1qv+e6otZg9EtEkh6hQSwBlagbZU:Xa+L8nVjtEMbSw8

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2