Extracted

Extracted

• • Target
    NEW QUOTATION.hta
  • Size 31KB
  • SHA256 d19a52218523096921521d6aceb4575c0773ee7f062cddc0aebb054ce37455db
  • MD5 9fa6552a0074b87f21d839986e80da6c
  • SHA1 0dd1f2eac74a73c5afb3a666fe891413b4111fb4
  • SHA512 f3deffb910ef6def9efef8bad210a4a38abb41b3854dc711d250cf00b6aed7f0dd54f51c2bf801f76f334fe7a90d96a5f1c55ab76729703e50e431d39723c6d8
  • SSDEEP 768:F0EYgLe2WFZLyXmb8SF/3y86p+uC3iD6CZwi:F0EYgLe2WFZLyXmb8SF/3y86p+uC3iD7
  • TLSH
    T120E257009C5E026868619E8A57D1453DAD423B30A3FE9E15FEDC2E8B76221ED35CECDD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojanadwarepersistenceransomware

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2