Extracted

• • Target
    ACCUSHARP QUOTATION NO. 106794.exe
  • Size 1.3MB
  • SHA256 3fb510b7526dc753632045edaf094073c45f74fefdc08b5c2fbb9f8e7ac483c4
  • MD5 967e5963a2133e9d9edad63f1ffd2b45
  • SHA1 823a814767b3f848b6c99a1b67c65eb70cfcec86
  • SHA512 74709830c254b6605fee5321196cb91ae8ec4e5d3b4e62137395dd76f759ac4229d08ef721b74326f1cf9bb49fbf57a816e9cb0938f2fc6fcfcf2b20350f0fe0
  • MD5 SHA1 SHA512

  Score

  10^/10

  spywarekeyloggertrojanstealeragenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Deletes itself

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2