Extracted

• • Target
    El Kemble PVT Offer for enq01-FKM60.exe
  • Size 2.1MB
  • SHA256 a1e81b75eb6f2ae159e5994dec6d82df836ae7b89666c4567c3dee8c3d486d43
  • MD5 0cfcf9ffaa76ef4d70215ee7b3eeac23
  • SHA1 87a134f61b79d669ddf002a1e5b6156e3f78dbaa
  • SHA512 2444fd2da960148af3077847da18d7b754ba4bd6f32ae3093bf8f05c7a902b981bff4420d759a30fc2db9f43c8582161906b9659697c9c5ac89f3d338b2b7523
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslaagilenetkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2