Extracted

• • Target
    DHL_Statement of Account.exe
  • Size 634KB
  • SHA256 0ef7c8a77977cad0c01973b63c83892ff04d3da86ecf5e6bf1f2427361923864
  • MD5 914cdcb7e316faf91c5a195bcc07dd5f
  • SHA1 993ef72b134461e3caf32a4cede72f2e37c86bc4
  • SHA512 1396f85b945dd2d57e9fb4e43d49195db2c597d5f9d259322f7e11e5ec3d16d5ae7b0df9b64806c30c570954d5fd8cd3c6c8761703561a072055104a8932f2e4
  • MD5 SHA1 SHA512

  Score

  10^/10

  keyloggerstealerspywaretrojanagenttesla

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

    keyloggerstealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2