Extracted

Extracted

• • Target

    ADOC RFQ-WCMS-18097255.exe

  • Size

    512KB

  • MD5

    e8b22fc2fdbc5ea49e57932acbb0f222

  • SHA1

    b75c53a08c09716b62fc480628f34b1806c288d5

  • SHA256

    e5a67f4da5b8e9ecd086bfa4f6b8e49843656d2dd8adba4840ee9cf46da3054e

  • SHA512

    2897e97a2de75d76910aee60c2e09758d057cb048b52e338d1457fb630f1c1bec2844e795ebe768b902880983471e0ddc0612df8337b3da52fe8a28dd90aeb08

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2