Extracted

• • Target
    SHIPMENT DOC.exe
  • Size 984KB
  • SHA256 313cfc168cdc0f9f7a01a8ee6afbb8e67ba9b89a672ca4ebe5d754e0545dca28
  • MD5 3ab9a1cb386fedec6a8039edc7b5990f
  • SHA1 46818d905c75d2bac0ac7b06fd6ef72b5b6adad5
  • SHA512 ddc3788539da3eb244a759bd3262f422c1cc50bfbcc49cb15cbbcedee3f338a9fc662ef8ba3ea5c4a5fa81a1f4aaf839750398b0078c57836451755928e7d7c7
  • SSDEEP 12288:8JsQjL9QzX7BIBi8pV4VpQWsNTAvsEOgAtzsWWN5WJeGciCK5XqEgHrc1NfpHsVe:mpjJQ5B8pnzT8sEasxj9KJkLcO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2