Extracted

• • Target
    AWB DHL 7214306201 Shipment Notification.exe
  • Size 1.2MB
  • SHA256 a08d9cab8798980e7dd0ed102dec9d6f09b072c58028cf9d2a1623bc7e77dccd
  • MD5 9b0b7f96b4e231a8baf1ada19337a6b3
  • SHA1 4e8b874b64a9469c671e569a0a2dce4f825076e2
  • SHA512 844d179a34b53cebe5bdf22d7aaa0f547b313fe923e23f74fe1d7ace70684e82851ef24094b083a46f11a9c9fbc5946f03995f1841a02dace464d616eac35a69
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2