Extracted

• • Target
    New Iquiry.exe
  • Size 552KB
  • SHA256 3b91f298cfdb9541f0d548a38576e37012c645926ab3383d21677087c107b52f
  • MD5 1393fb7819f6038dba4822d3fa0b34da
  • SHA1 4b7fbce0e12551ba62702fd1a20041caa9fc8575
  • SHA512 a72801f079a939d09f14b8e761c44c35e2ab8a91fc40caeb32e3200382b08f3a8ee148989ba9fd05fb05c5c77c5874fa8402524be35fa71a8b7427232abdf90c
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2