Extracted

• • Target

    SHIPPING DOCUMENT.exe

  • Size

    824KB

  • MD5

    39e6da69e880f66e9ed1e25b1bc0b632

  • SHA1

    935c61dcabeff014d2de542ad89bc38cd603f7d2

  • SHA256

    1c71de5816aed5c4f8d677703ee09567ef0b80fb2e50acb2cf1c1ed931660ef1

  • SHA512

    8c2af69b6accf039e01c5498468e306b4018056a41acddcd30b4589d37829a5f37a098696dfec9895b566de6a5f546d0a349bf9efe8b5df09678f669240028e6

  • SSDEEP

    12288:12wRwu06TJi9QTP5iIpQMj3TXtMPnJHiW6N44HJ3b43PLdrUG5HemXlb2/CLzq1l:/lUGhpdjDdMPJC34GWLdrS

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2