Extracted

• • Target
    DHL AWB 5032675892.exe
  • Size 796KB
  • SHA256 a9c8b6ec1d3d72ddb29a511e1fc672176d5a3637cb57a32c40d3043af22bed5f
  • MD5 6a0f466407492013e80dcd780e5da3de
  • SHA1 6f17f6971462ad11ba703914efe362845aa47b87
  • SHA512 136aa8c0c67f1b548f5421d290840dd50a2ecb9596f9131e9b5ade590bb659741e468e0468b8e04ea418ed5d5c0b2a4c0c4a7a7f85e477c93393b5e6ac8c6bd1
  • SSDEEP 12288:UUlRun0haDnLMzIL2q+RTdOL8TE1WSJrv1vLgmMr//sjnH+rXsFyYu1DJG49O:UUlRuKOyqGUL8evluUjnFy1P
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2