Extracted

• • Target
    DHL_express_package.exe
  • Size 591KB
  • SHA256 c8e57eaa8b0fcdfa8cd3db86591975ed151c5e1751997a94fb0d9dddf62aecba
  • MD5 16c3bb1063950e08cad8d54aafa5dac1
  • SHA1 e9a9db62e38b2c241ec73cdeb8cb77c17e0188f1
  • SHA512 ba2c09252a9d01344256284bae7f01160ad9993845ea0c338113969ff7b3666a76488830d8cafaaa0cb991e8b478bb13c07936dae8c0d308e2969df62a517b2e
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencerezer0spywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • rezer0

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2