Extracted

Extracted

• • Target
    Quotation request LM-23-1552_PDF.exe
  • Size 585KB
  • SHA256 1428623f3d2769a2f63e2e07444e0af8f334cdcc0b8d38faafc06dea97ee322c
  • MD5 5077dcc3c4bdbfbc0c31a87612074652
  • SHA1 7401ee576936a120ad75cb33a3d7405c4a88a6ef
  • SHA512 501c7c15ff1749d2ad101fc1e26e997625f068974c0e2e966ec71682540c270c656035f539883cb4eeb7121d62915fbdd18bdddbd869378648ff0e86b335a0c4
  • SSDEEP 6144:Ap6cwjHkrCSfmEOijRrnd+DebGzQ1oducBnuT4W+f5MpvTqB78xKMYs+756x28KO:Jedc5010ueuTkSlqyYs+96g8KaEdA7D
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2