Extracted

• • Target

    Request for quotation.exe

  • Size

    525KB

  • MD5

    b1deea9b9ea02d98ac34d0e778d3b596

  • SHA1

    62d4d793ebc2a7ffae67277f5c138e9c1103648c

  • SHA256

    6b6e59a4d06a6facb44ad4bdc483ea0de5edfcb0422a7c1c477afe3a87180279

  • SHA512

    25b7314c3c5beb1d21a4ef027723d3e38dd69814807e0c060b06815a269930c3993a2e26fa87b8606c35550f1f196d42f813491b15b61321cac3b39d5c729d42

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2