Extracted

• • Target

    4 Pallet Shipping Docs.Commercial Invoice. Packing List. Bill of LandingTHS00945890370378494789.exe

  • Size

    605KB

  • MD5

    8c4310091d5d956a84694e96f763b090

  • SHA1

    d4177b3f09cf8f15a1be26ecb75f56eacca5ef1b

  • SHA256

    9ff56d0d7ffad36dbc36e4df7eb4440b2a72a463d51f705f81577bcf45a90b2f

  • SHA512

    f967459e528534b96c153923029de06a5eecdcda1de65dddc75fb9f7c7ceba34900c8bca2929ee34af88648e3b09b0137189320084b9d4bd1667b8773cee0ec1

  • SSDEEP

    6144:qnqdmWp/J+DZaYieGmEJl55R6/QAqvK0++8uIcli5Vi12H9UtbZLFTQqy0F1x+Aw:0qoVYdrM/mvKD+w1faLF0fwx+Aih

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2