Extracted

• • Target
    Tender products sample requirement.exe
  • Size 617KB
  • SHA256 c39d2b521f5ad659826516372c61ccaa1bb588b2d7e05bc66fb069fb83feb4f7
  • MD5 f93d254a32736da547bc3a3a1c154eca
  • SHA1 ab161cd17c915d127cc17f5d2ac130ed5de74e9c
  • SHA512 1d3cd836910a012a9f5c44f2c89a86284e575213e684b568a44b378b5ae07883089d937420a06895da28f1629a50a152db5f50a5da1c000c017588006a828c72
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2