Extracted

• • Target
    Air waybill no 7910004152 dated 13062023.exe
  • Size 326KB
  • SHA256 e4b6f95557a2356d046da60a1ca4e52d302618108fae774b8128ffc0586366e0
  • MD5 0cdb0c7a7c1f2caaef27c75ef8481482
  • SHA1 a5a806d4cd8885e76ea2e5860feb90382dac72f1
  • SHA512 02a271c67363078c98962d881b54bce83292b64ae5080d345a18b950e332df9e0e1ff3d0fe99ed49bc5f3bba28eb32e79d961c6b13e3f235320acf7fc4dfda61
  • SSDEEP 6144:JzAJW0SFZ6zM65lS3YQ3QjNzw8pg42WrBfT6DcqoeqRQiF0cW6yF:5H06OlSIQkNzw8pg42WVL1qFkKcWNF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryagentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2