Extracted

• • Target

    Inquiry162020.exe

  • Size

    561KB

  • MD5

    545f0d6c85e724cdf181bbb695d6adb1

  • SHA1

    d2593a8ab114593c16b77914acddd9d917fb58a1

  • SHA256

    b6e27dd859c2b932284d6a65629a1df3f262ba01b11c56281935dcf6beecdf8f

  • SHA512

    2b896a6b3f09148a5b912d5a4e2cf0014ddd52abc3ba38f67ca79bfc53f440802b45542cc9b4cabedd5c8e0cea9f413c0a368f98fc04adf4ad7af456cb6dceee

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2