Extracted

Extracted

• • Target
    Request for Quotation FPG SDN RFQ260619_Pdf.js
  • Size 33KB
  • SHA256 f5dc559fb2d25f2f4eeefca68be80f8e4772b038907f19ac5864331a37917d05
  • MD5 e45a786f15f6322dc9bff3d2bd4c4d7c
  • SHA1 5397057076cb7bbc7e1ca4be7b8a56912fe05116
  • SHA512 ae3c22d2a5101b004e87ba3d722ab1f3f2d44a74b007237dbca6efe296e96bd7b38b8902387c637f9b2800a3e0fd5f46a70bc08e0d24ce7f60ace15c6749b558
  • SSDEEP 768:59wlWqBBmEhCyLjF7aI5BGrRG6R/CNbu8xpV9uMlffZGx6F+g/L/MXfU2qbDWKzS:59wcqBQEhCqJaI5grJBC5u8TV9Rfo4oR
  • TLSH
    T1D7F26A07151A863A069C6398D75E08FEEEA0883332205DAFA9DF7D359C47A1731973DD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojanadwarepersistenceransomware

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2