Extracted

• • Target
    INQUIRY.exe
  • Size 494KB
  • SHA256 fee4980a1f01ebd4ba05ec27d0d03f7083e2b3cbc959e34d5f238865637f9e7e
  • MD5 7c3bb89998541e008127b65872b9165f
  • SHA1 f1ad5132ce90ae94a2a3586bf801130b3b72ae28
  • SHA512 cc11c1a73d0f3b25a9c109d092d6d50498a3a129e47761911f3aa435224e46b434d2366135892150371b99ff638de1b8777e1e6645aa049007e9abc05056b783
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2