Extracted

Extracted

• • Target

    Item_list_RFQ#7292020_PDF.exe

  • Size

    754KB

  • MD5

    57891ee94b88b26cd0c764e93893c2a0

  • SHA1

    342020d38ff8e233fa31ac06dbf6f8ee393d3bb4

  • SHA256

    0b85e80e717ed9a5901bcaed1db1f0bca254efb93c024670046bf5abc669d833

  • SHA512

    e1acdf42a0adb5f9d1a7a28895ec652e8cf5f43d8cae47cc3dda45c570c2248eb282b610c7d349ac9428b075d59c6a631b6e4b5013954fabbc22c1ad6d7606f5

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2