Extracted

• • Target
    URGENT QUOTE _DELIVER TIME.exe
  • Size 1.0MB
  • SHA256 dfa12558abb79cf34f77efe7c71a0dfab082f4e5e40df271aec9a7792b248d17
  • MD5 96608e4043fd20d0a3451d1c75504e70
  • SHA1 32229fad95163780676435cd799f4cad37630864
  • SHA512 3887add211710d42e66f7065c73c92989f838b9d8144995d08587054adc40effbae4257f75fef6e6db7c3751f737dee707b96060f348735c608d730d9d0f65b3
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanpersistence

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2