Extracted

• • Target
    Inquiry 40140.exe
  • Size 767KB
  • SHA256 6557f7ee32adfd50c44568fda13bd4591354c4f8d047815fd22ee67942d52bda
  • MD5 cb2667d6821439de831b0ec242be35bd
  • SHA1 b1bc39cbbcc860519c374051a08e3263e7469c91
  • SHA512 5d5f39a21e0c4ee1b7ebbf9d64359dee5f8ecac256f6ead877e84420af21457eb3db48d9ee882649d289933d1d62f1fbc61f947e3fc61905ee7ac001a1ad8596
  • MD5 SHA1 SHA512

  Score

  10^/10

  upxkeyloggerstealertrojanspywareagenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2