Extracted

• • Target
    بيان حساب DHL - 1300397971.exe
  • Size 725KB
  • SHA256 367fb0e0d122f5eabd8d344d27bd9f3aea9ed0959b5186e54ec18137a2854cc7
  • MD5 4c6923f74ab77b5ebcd79181f7fccfd1
  • SHA1 f91b56cd77a2579c6451fc5121476d5c849f2824
  • SHA512 5966bea9455fdc12ee460d7e184e61f6b82471d12775136740819c801b67f9b919b412b16bf63c306daa149faf5237d06027e8f6821c1e24b44d4ecfcf4c0f7a
  • SSDEEP 12288:uJ4ayp7tL+NI9uR4cfRJk17VsFjAg3uODCFwCMpT0/1oOCBzcKGl1+k/0Q7Prd4Y:Fp5H9VH17ehA7ODCFXMp4bYzGl1+k/05
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2