Extracted

• • Target
    Request for Quotation-BV-76435020.exe
  • Size 675KB
  • SHA256 11cbefd8e1c96efcac9c45d4da8d3ceadfe82666c6513a5d09586bfe24139bed
  • MD5 8888b27d8bd177d4952e6d50b322168d
  • SHA1 d8a352c8df28f21bb7a9600d7006367b1f66b99e
  • SHA512 bf40909481314ec8a095a35d086a8285203b8a4c911b338ce27c8cdc5c262743ca7c3b27394a3ab303ea7257484ccd1f4e0f501faac08b5afdbac9a41a71858a
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2