Extracted

• • Target
    RFQ.exe
  • Size 420KB
  • SHA256 ffd474ba42b484a0c7eb8688e37334d55e65c49dcb88dcf3bc542276cd7d5348
  • MD5 55ee586dd55c291e9829fe345028de76
  • SHA1 e1457c39c4412c5b7ab3f12767025177f0b6c03b
  • SHA512 fa5e1ebcd2573943da0c5926ae232333ec0c17536fdfafd5be0b675f5d569a27e7727ee44cab6c6bec27fc9a81dd6b09e90a6490242b296a00561fe78564f42f
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerrezer0spywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • rezer0

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2