Extracted

• • Target

    Urgent Quotation RFQ-HL51L05.exe

  • Size

    387KB

  • MD5

    4db47e60a2839966b6cb14d69a1c3874

  • SHA1

    55c69f4b300937aba360062a04b9d41e6e25fc83

  • SHA256

    84b2c85896e126daf30adcd3942a299db9c72d6670c0e9accd6978752f87ada7

  • SHA512

    98d196cfb02f942aaccd0200ff25cfc62326954637c800f825150c1bb8b581184fd644531d2fa16513d3d8a3678ffda0f88223cdf71c29e74a07acf18133ae2f

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2