Extracted

• • Target
    Company Profile and Quotation #20200804-4563.exe
  • Size 845KB
  • SHA256 4fa84ddee70c59516a5727fa29bf70e548550592998cfc07b9b2b80325756b35
  • MD5 4e0a15308adcca795ccc1d71b6e0f09c
  • SHA1 fcd9c595168b04aee6be154e1204d63e5a676c6c
  • SHA512 d613ca06cc09e70eb2c58a11fa2aa9897f016ba57eb7d6fd6b397c48d34cde5a970e5358d6e44facca0dd93f6137cbbfaf5b3fc907237f74a022b9cb3b896771
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2