Extracted

• • Target

    DHL Confirmation AWB200519089966.exe

  • Size

    788KB

  • MD5

    7b27f3ba2751b9eb00f4ff7bee50acae

  • SHA1

    155b2977eb76171d1709c923df1f35b7e02b262c

  • SHA256

    4f72f52545b73d039d37755b2f7c1aecea39abd72fa0dedf8081a03439406ab5

  • SHA512

    f603c153b75f86997d587390f17a240ba3908b00173f83ec460e47207a7b9381d6bdb727ca75ec45a7cdcc223002540642ff4e1491a7650ec81c585e83a44f80

  • SSDEEP

    12288:tyLttx8pfCqPNSXAtOOlbwaIWy5yw2RmNSlE3H4NW7GrRyb9:3pfCWtbbwSDw23EX4NW7GrRyh

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2