Extracted

• • Target

    RFQ 071.23 020.23.exe

  • Size

    779KB

  • MD5

    bc1fac98c09af837959226f91f6d54c1

  • SHA1

    5257b8498fb0df2e06259fa49a6b333f34603944

  • SHA256

    1897da9314bfab3a6feaae55d4e82fa4f764c04593c9aedfc4fde0f7e7f7a2dd

  • SHA512

    107d3f67e05e46f788c64bcaa3fa7b506a0b0ae4e1907116d0915fb9721fdae5b1bb48ca46a73b14b506909b3a6a06193578425043fb0f16591654b1dfbcb468

  • SSDEEP

    24576:jCVZ9BW+n+6AbaGZwMhK5Uu399i/Ml7R5:G3EK+fbbZveUuNP7

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2