Extracted

• • Target
    DHL Shipment document AWB 2375690032178_PDF.exe
  • Size 535KB
  • SHA256 223c38be022bf37ef243556438ecd472ae67bbb46fcf0e7ce4ea3173260141e9
  • MD5 3ad3b5f96c243434e6c17a150b6e4db1
  • SHA1 bffe463cb800e99e916602a7e58950325c444bdf
  • SHA512 4da2b77e26dbe66877be49424f6eecc5d34bf8689b6d12bf42d1ffb135577e0bd6c026c0d5bff2c4a55204d797f7c75d86a6e9eb034b57d3acdd329cdd9fe1aa
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2