Extracted

• • Target
    ENQUIRY_101.exe
  • Size 729KB
  • SHA256 f6ef92f6911bb14f5b8905f3964d21a9569c41c4e5367d0ee8aec59d54eb7024
  • MD5 5b14a7366cf5dbea3386c6afbd25f012
  • SHA1 2a39f1d215a739ddf4e2daf87fb42e26f12f72ac
  • SHA512 df11b3ff17cb7a4508a7629e978ca175824f4dae73f9cbdde60da7825ebac73f9c335fc02883a0bcdd007e8806c6372400eeb1e746cc97cfcaf051d55169a172
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2