Extracted

Extracted

• • Target
    DHL.exe
  • Size 481KB
  • SHA256 157a44ec9e957fb3b5732e4e3daee44c36253f01b40c03083b8ef77f53b4770e
  • MD5 6d4ba37fc44bf096750814f83885b930
  • SHA1 810393ca4c19b709dd8e9fdbef35e3a3e7cbf5af
  • SHA512 445676a15a280d41f95f54bda65ff203cf6aba2893388f3f0f83c5f217510bda01b232b09a4e61d5d26b5cf92e1ce710f5064273bb943c45b2d8cf7dbb4de965
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2