Extracted

• • Target

    RFQ-M-002-SRPP-Inlet Parts EQUIO.exe

  • Size

    1.4MB

  • MD5

    896d4971067957f0fd91c78e288c49b5

  • SHA1

    59ebc6aba2101d8331fe3731769bfb2d94c20e26

  • SHA256

    4155719102475db0b3532528f3d4571540267fe5a8c3b40e445f74aefe09c9a5

  • SHA512

    1511dfbbde0ef8f23148ccc5fc4cb8422374841f9933d90ddc6907ca7df1e55f169c7650aee48376d1a31d03dd547676e916d2c4b9aeb1b0597f0f4115da42da

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2