Extracted

• • Target
    Original DHL Shipping Documents.exe
  • Size 429KB
  • SHA256 c46279e663fc5dbea46759c2c1e77a7453514e7d0636553cb1fbd0d71229de21
  • MD5 984e1d7967952ab37287e74cb9b527ba
  • SHA1 68ba6c544e34d9513e2cdbe68117d5ac0be3b80e
  • SHA512 256709cade0f9072387a74b0c6ffaf1b75192e98f631dde239fcaf0725a6e0fd78187a939a63831dacfd1990db1c965f7f3679ce2e002675783b99bc34d03a02
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2