Extracted

• • Target
    ARRIVAL NOTICE & INVOICE.exe
  • Size 896KB
  • SHA256 2391c9beb21916a6b7f18cd2dadf9f9c19a060b75791f6052e65a683161d7a60
  • MD5 826a766370c80d2d2ab2d970dc9ef1c2
  • SHA1 10430128f54035e586154eff4dcac64f0b12bb10
  • SHA512 4d9e54ab4b7f8c0a4efa1af00f2a6b750196cce5ccc09d8ddfb59c6c04fdd83cac71fac512d483253a73c1efc79ba7c80d3553285307ace103f4599542d9ffa0
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2