Extracted

• • Target

    shipping document.exe

  • Size

    562KB

  • MD5

    303efa74e4e9cf4a07a685d45b62b2a8

  • SHA1

    43b21136f103e62f2af9745d3ffaec9883a52b66

  • SHA256

    7878c151e7275b02792479eb673f4406f15aca3242e4b525ddecda93c06ea312

  • SHA512

    b95109a37d83c735e20a37dbecfb3aba712f0e2460c329c7db9cc28b884ad37af5b2e42ff5beb6afe5798440cbd6108c85cf8d4890c06140f4c80dfa2976eda9

  • SSDEEP

    12288:raFFZ6wajEsd1U+WvDeToTopNGpR6bxRXO/5TiTm4HoFzLj:g61jEsvSYoT8w6bx1O/BiTjozL

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2