Extracted

• • Target
    DHL Shipment Notification 4319464144.exe
  • Size 1.3MB
  • SHA256 810d6fedd690fa86ac01ee4b15a1038d2b045ccc2a10262f1c9bbd04cc1ee935
  • MD5 04f689c0441b257f176b3beeb5aabc9f
  • SHA1 f7a4f90c50f1c070fb88bd485554ccf5ec7b760f
  • SHA512 17a99b339a02f3bab4488130e85c60077c14e58ca9eadcbf2e694b3bf3f3855712d2057e520ac2d1326de36522471844d533d93e84853d613714955658b9c263
  • SSDEEP 12288:6UbUJ3MzSSV93QMOEAlzoQb57wUOBBXffbQBKY4RcDdWfQnmwzMAmrxW0Hr:ZSSDYmQ50BdffcBKY4HonYAmrzHr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2