Extracted

• • Target

    DHL shipping documents.exe

  • Size

    682KB

  • MD5

    58ee377b030f6d1a380b76eb27087448

  • SHA1

    62bff8fa4ab84a7809645339a67455e2ebcd17b0

  • SHA256

    2fbfd8a6b905dda74da9df102c7e161a9e4128e733a838aa644504dfb742ecf9

  • SHA512

    4c339198fff413eff8555f450d91ac3df7c55ed045cf775d14ce5e7f4d2a27d975ee6848e4e09a71f9c2f117378daf869d768ab9a59f103a627d54fac2976536

  • SSDEEP

    12288:NeJ/sI+up7hnevR9sf14ekA1/zio/vdcUdm+BE6fqBgTehA3jJBYyimOMt+Mm:8F5S9LtA1/zioXeOy6ohAdKyimX

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2