Extracted

Extracted

• • Target
    SHIPMENT DETAILS.exe
  • Size 611KB
  • SHA256 826e2330ffab2ee9cf4c87e234c3abbfd9fadbd4db5769778f28ffbd8a0e18fe
  • MD5 8b0b1106e334f79c9da4ecae2d41d26d
  • SHA1 5fdf53cc636b6ea8de48556315a07f6ed9a7f459
  • SHA512 54487932d22cbba8bffd997bda0063246bae6e5a9f7a6d4b79d39701a419366952c036eec908317fee5ee3db7651c82200cd4c0ed1e8bbbb5b1b3ec7fadbc2a3
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealersuricatatrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • suricata: ET MALWARE AgentTesla Exfil Via SMTP

    suricata: ET MALWARE AgentTesla Exfil Via SMTP

    suricata

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2