Extracted

• • Target

    inquiry.exe

  • Size

    449KB

  • MD5

    f68a1350469f33284215b4bdeece9684

  • SHA1

    a18e517eb1409c06d73cae87d3253ea83ad8c97f

  • SHA256

    ca8f27e8398ec81d1bbaa5714ef8bb4c557edeb706690bc031a3089c990bbef1

  • SHA512

    8d47ca1fe59f89112b09cde3648e8b2bc4d29cc9b5abcb3019b4d35fdf49d8e9671ca61674154a9ee02630b137af456b08e691996d04cfb1a3b72445d261867e

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2