Extracted

• • Target
    RFQ 52165 Materiale vario OENAGROUP.pdf.exe
  • Size 916KB
  • SHA256 de8c7c543f438af1e7e78096f6873268e9b1a12745edf9c88db07e136163399e
  • MD5 6702210599cb1c1dd3a332e2fd681785
  • SHA1 4ab8235f879e479c4dabaf83ff41544dc24d8bf7
  • SHA512 07747f2d10d3cd07c2b0087092f82879b18a471cd507d7971b7ac92fe476fce6d464a346c862cf298de701b2439d53984e610c5472da6425fe77c98244eac579
  • SSDEEP 24576:cP0tkNRBASM38mWceqOqNLEIw4fgPKvUZ3AP82:cP0+bBA58mWe3LX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2