Extracted

• • Target

    SHIPPING ADVICE DOCUMENTS.exe

  • Size

    740KB

  • MD5

    84d6854899e7c442c48d8852b3494b71

  • SHA1

    077936c86a4ef360e92c3733abfc6633193d9583

  • SHA256

    8bbed58c768c4123970a67377ef324e3395883269bdc99a5bf97853eb551d70a

  • SHA512

    369d27e20ee777c5d8bb843fbb75e4174cd930df50dceab52c6feae5500542d000f2a2eb278b6cb6574cdbf9c7202b58e0b54b0c5c8e6a0e1780325216729fc3

  • SSDEEP

    12288:s1CFpELXGkJldiJxzHxOz6Awe/DpDpCrUkIP1CLmZD+9Km87XvauYqD8J:s1CFpQ2k7CH0z6ALphkIkLUD+9Kf7XyJ

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2