Extracted

• • Target
    334# ARD_QUOTATION (2).exe
  • Size 343KB
  • SHA256 49dfecc9b9d122b59de9c748c4c86308d6666a707bcdefa910cf9be7780b68bc
  • MD5 a5dd8befce625f4928140e456e248e1f
  • SHA1 f7f745449a60aec3585a0be92ae47eb2d1f4ab79
  • SHA512 ce3b03f8403b555e37bdad6972e3996a59f0f21edbdb6301733478af6e0a398e2cab40a4ea53394d1355e91ccabd07fb3cc40a9fcd3cbfbb923a4072452c42e4
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2