Extracted

Extracted

• • Target
    SHIPPING DOCUMENTS.exe
  • Size 2.7MB
  • SHA256 9d4040bf5689a6d0022bcd062cfd40c3d17601e4713cf424876a2b65680dcdbe
  • MD5 fea9b35254ed7b966ff15425049b124c
  • SHA1 760f782db422e1983b830dee395f2046c1f8225d
  • SHA512 885b2989f07eecd8af6b781ace519222e93aa3659f42eeec9de560d0fb09ee477b8c4e11fbbca8488e1fd7bc6669f418f14a8239410700471614c20bc144bb01
  • SSDEEP 24576:hVcHOQOjeDYU+B3Zt2xckiTaBiWkoQiluIwFpVRRhltDL7do6Fyd5SQoW30kk9c0:sOaIXckoQiItDFot5CklQo1Q
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2