Extracted

• • Target
    RFQ 17092018A.exe
  • Size 414KB
  • SHA256 69fd7fce357ff849a34d669c808cd75adbd9bdbe8999bc035d353a7f235c6169
  • MD5 a13e6dd3515b7f1389a4bcb5ff150bcb
  • SHA1 f0f7c2c62fe197dfc97e5c5b6ec7d3c46dc24e24
  • SHA512 4f934d1dd78e407694676d586b52706418d46cd035c40cf39cfcd75a6953a30638cf4cfeb03b69c425e93d1065c9ed0ebaf0db9c3f8387704300c1e573d75e6c
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggerstealerpersistencespywaretrojanagenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2