Extracted

• • Target
    CUD2025ORGRFQ.exe
  • Size 851KB
  • SHA256 1fd01b430ccbb37347f138336cfecba2b6ac2c1eb2094a016588c448b092f7b3
  • MD5 ff0ccb524ec4ffeb25f3a98b67b21c32
  • SHA1 3449b3d08c712533bc6203bdef3ba1da54b453b3
  • SHA512 6e31424929b3c0b83fdaaac0bef5953c63345dcc5ca7cd23f3a2ef270b7ab1ba57677349e5b9f4b54da2e1908a6a2f3f5d5bd599251dd0160c7fc93e56fac04b
  • SSDEEP 12288:w+J/N3k4QaPS1+nVjfAU83G96nLYzj0/DFNHYT2lPK7J3:PJ13kNYVjfAQ6nkzjc+2BK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectiondiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2