Extracted

• • Target
    URGENT QUOTATION.exe
  • Size 549KB
  • SHA256 150d964fbfa64a31d6d9846500d2353e2aab67c7664cd222244c8e97c8e24b95
  • MD5 203695345c45125e54608c6aed247b88
  • SHA1 8bb6d8101db17c8337b20797ac18d2c8c0fc56a9
  • SHA512 5043c3b6c48c050c71a723ed1bd3a8a0951fa97167afdb7760649f783dee99f90aa925de260a1d93d9f214d8c98060d2b8c1ce7b1abbbf54a720337e0880443d
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2