Extracted

• • Target

    Shipping Documents.exe

  • Size

    1.9MB

  • MD5

    e0bcb417f88eb3763db1da03853375e1

  • SHA1

    3a4dafbaacf7127a7bd55a20346d9c857e01b5f2

  • SHA256

    bf744936c8aa55662bebab8ba8274b7aafee33d076fd302beedb1a1ba9241afd

  • SHA512

    b718af048706bf1b66ba69b429376702fb59dc03055ce22a10821509f80ba2beddae176a7234cf97ec7265a8a9f97b2ccc61ee4b11b086054799275549b7a1d5

  • SSDEEP

    49152:sPKSQTERAQO3i2X9QfDjii+ZoEpNJHXXXS:MKSQTvmfvI5Xy

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2