Extracted

• • Target
    INQUIRY_SK91403BWK.exe
  • Size 977KB
  • SHA256 ea17d1ff94d88763098609b49e10167d233c78094cffdc95a96ec99f5ed07cf5
  • MD5 60525979521f952ba05efd31588cbf9e
  • SHA1 e0e27365dfc4c5017207f0fefb88e6e6b697ccde
  • SHA512 3d21551669aede31668bf10c7427f40483b08b1e3d714f4c8cd43c0aa6f355cae45fea375e0b7203c6aff04c0e729a8277f94bf9dbe9a8980fb2dc0331fa825e
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2