Extracted

Extracted

• • Target
    ADOC RFQ-WCMS-18097255.exe
  • Size 512KB
  • SHA256 e5a67f4da5b8e9ecd086bfa4f6b8e49843656d2dd8adba4840ee9cf46da3054e
  • MD5 e8b22fc2fdbc5ea49e57932acbb0f222
  • SHA1 b75c53a08c09716b62fc480628f34b1806c288d5
  • SHA512 2897e97a2de75d76910aee60c2e09758d057cb048b52e338d1457fb630f1c1bec2844e795ebe768b902880983471e0ddc0612df8337b3da52fe8a28dd90aeb08
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2