Extracted

• • Target

    dhl_doc7348255141.exe

  • Size

    900KB

  • MD5

    643f996e34f83f00954663f0f9f15b39

  • SHA1

    34f9447e70ca70d5d1dfc24ea5e310d9012e70aa

  • SHA256

    5f424b8c80f27423b12cdf9d7d6a70937edb28fe07b8ed4dde0e965810cbd674

  • SHA512

    67e55e50e0980336dc3745df76dad53d040b5b30eed48b0ea760077b991a9f5127df95c61d1a1424a0c613ac752ae20614983aacabd0848ccbb909108d0e9338

  Score

  10^/10

  spywarekeyloggertrojanstealeragenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2