Extracted

• • Target
    VIET RFQ H2323ED.exe
  • Size 580KB
  • SHA256 bce716f916d2a77fcd894883860b0eb78c69cabf7724e5eec0a097fa35f60d81
  • MD5 7de47e8fb4e76ceadae774be81c02cbf
  • SHA1 f1177ed8849f9c95d84082c84d26de32d3032829
  • SHA512 d1a70dc09bdb9d325e2790c0c23c8ec03e28f4da3ac4e6c8f6ef7363148e96d96f35c97165ed0dafe45432a3286dc3c0fa862928ab5977590248b7ff6e66632e
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2