Extracted

• • Target
    shipment_969988296.doc
  • Size 21KB
  • SHA256 61f88a66b9c446e2f9692913541fb41bd42e8ecb3649ae7c2921a6d585d9d169
  • MD5 f048f9bfe278b3927196e84fa1c249a0
  • SHA1 30d525cfcf58afe1b19adfd46f3a328eaf6414aa
  • SHA512 84f23b71d1d8afc0dacaec1c39bb7bc73920c7fee6360aa09a27661a8fdb4a31185376792c36d20f1270aa859094d2c8f28db931e69c472721c1e6317ad497ae
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Blocklisted process makes network request

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2