Extracted

• • Target
    Machine quotation.exe
  • Size 730KB
  • SHA256 e8a56f0e1fb9b0979cc6f15adde89228cade12313130671eed959bdafa39f8ee
  • MD5 d4d39442c07f35af205a831938a9d64e
  • SHA1 fd5ae694dab7e45674867946c68e29c6e36f2a8c
  • SHA512 2f88f9405e4c6c70d11f2a18ce2f07c6e2c764b7b4f0ea4a665b802faf027acb77e16d1d1c7168715599c14a9ed867180ed99649e2d4713287b9b9983e601704
  • MD5 SHA1 SHA512

  Score

  10^/10

  persistencespywarekeyloggertrojanstealeragenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run entry to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2