Extracted

Extracted

• • Target
    DHLDB00118380920182.exe
  • Size 683KB
  • SHA256 264d7bdc0a0eb2f2fcdb842a8556b06a017d5c88a37514ce8e883ac2f00cbdd4
  • MD5 41789d8716368f43092dfb82e4a5e5a1
  • SHA1 7105e5a89783a9f320e1c6f2fa71e024f3164ff1
  • SHA512 0aa2540cbe50acc434837264b6edde10a1615cafa337827d1346e8bc5ed769640cdcaefc6c32248be6f194b4763c8df7344ad740ea918ce338e45906af82d9f3
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2