Extracted

• • Target

    Delivery Details-4017235.exe

  • Size

    657KB

  • MD5

    b96ef7ef336a386518cc41343b73e0ee

  • SHA1

    9fb1228658d14090b7189449a0185ea0b7f4a9b1

  • SHA256

    fbb8dd09df0e0c79dcf488c021765e4fa915ca3a490ea45a78b622565e920f1a

  • SHA512

    bc8f327d7a3a4aab24542444a52e3a9dc37593463cb5111ee51554991f8d08349cb714bffeb646e19de1bc25228094a7d15ab8e0c89999cdfa6741fb7ce3b176

  • SSDEEP

    12288:/ORJXJTxiggTeCB0HA01As/hexT2AM7LBLX/RfltHEbbJfGJ1g:+XNxiN6UyAVUhwjMJT/RbA5

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2