Extracted

• • Target

    DHL Original Documents.exe

  • Size

    1.7MB

  • MD5

    14b11f327b8ff84f50d86fb3f2fb20b5

  • SHA1

    8ec121159f7c887fc76edb8b753c77d455ec2f7a

  • SHA256

    b10a2b32b0de00faddaf167bef405952be39d31f0236aaedc975654ef70f6800

  • SHA512

    897b3f4f0d8d34c0e1f36abf9ec4f340293d08b752c80886b358811de010a6e735b53194fedc73e15618a532f02f7968784fbd7f25cf927d2192acf5301e805e

  • SSDEEP

    49152:3VOYAsQBjPOPppNszMoXmp2hEqfvQsT93:lOHDjPCvszMoXEYQod

  Score

  10^/10

  agentteslarhadamanthyscollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect rhadamanthys stealer shellcode

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2