Extracted

• • Target

    DHL_Doc.exe

  • Size

    555KB

  • MD5

    d0a1d49d933944acae0f8a5f357f3afe

  • SHA1

    758867fed338a4fe9ebde2b252fb17ea99e4e2cb

  • SHA256

    e163660f2b270299aa1ff5846e0b7b8d9eac1f91ad2d3f5cfe3cfc261123bdcf

  • SHA512

    9862f092f38ffc1c42e2600361e34ae8f1e9f0507035150ed54fda6b0bbf0168de427fbf2047fbea800f30b142e7aa77eb9b0517b79ae3453bd8f036aad19085

  • SSDEEP

    12288:NlVv6NZcuDVsfhoTEJy9HcuJomeGJd68pxW7sJBqhjiYqOLt+icsVB:1Cvc6+fST8G8zm/cGM7sJBqhe3mtG

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2