Extracted

• • Target
    RFQ 11054 -Items.exe
  • Size 890KB
  • SHA256 71a4df5f7ec7a6fc953f090d09b068a43b7fb10ae0050d759f32aa2e48c8377a
  • MD5 600ceabb2d0a62346a5969353e70105d
  • SHA1 5dfba50ef6457f7d9c17a80f6b6da9afc60ee7e2
  • SHA512 755d16e91a548f8997c72879f5026713ccd14cca087646e40dd9f9f503bda6fd76a59c25822c563c6a50c444ea2d75f6774f483786c38db5e0348f3c801c63b9
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2