Extracted

• • Target

    R F Q.exe

  • Size

    854KB

  • MD5

    f1c29a78359e767adbd42221ba8b7b56

  • SHA1

    4e58abe556bb71a5596fb9e5b098028e8acdce69

  • SHA256

    e9cbd624aa2f7a22f007f7bb3c9a3e9ffb857a80db1a10427d5b8ec50244871b

  • SHA512

    e16e6a7ea1a78a5fdcd592a7bb7206c297114b342dc53a789eed32989de4347ea8445920099eb065fdd151aabce42715590c0f872f211875cbeaad837f360b8f

  • SSDEEP

    12288:ZCueH5qPLOZRIiD013VVAcXVhRzozvIjfOcr7UVIZg4+K:oqPqZRjD2foATV3UeOFK

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2