Extracted

• • Target
    SHIPPING DOC.exe
  • Size 850KB
  • SHA256 5448a677e4ad2c66e2e7a2d9ca0437e48ec6f0e9d0239744288922d8da6f7e83
  • MD5 00921d4a9c2553238e41618b907668a6
  • SHA1 008a1ba1bf84fdc63f0e732ed30e6ab83c8cc3fb
  • SHA512 bea809724c1e38726cd606d9cbf42ed0bb4fa8419a59c5ab9bcd600d532e8f7f1e8f48bb8dd9eed1e52c82a61c973614fada4511410d52b0ac4fafcb8416c971
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Drops file in Drivers directory

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2