Extracted

• • Target

    DHL-AWB.exe

  • Size

    706KB

  • MD5

    813cde91a2add539ae8ee2b52ebf0c22

  • SHA1

    a0dc1d60220b9bf0dcf3e28e13e40fbdfaa36514

  • SHA256

    9889d1eb31d43028e89ee3881d3f4e2a46baf14552fb9c5edc4bca8b6678befd

  • SHA512

    b220f4163db2a79abde21889b171dedf215f54ddd7f7017281e86f72e2456e435f6f4cedd5c7e0dfbc6d724f33d5e41530bb33279664d204f7585dbf8aba0e84

  • SSDEEP

    12288:DiUHMH91DzZtmOKbgQWFbhnBmschLzj6W0o:2UHMd1DtOFWVzEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2