Extracted

• • Target

    FedExReceiptAWB85021012746.exe

  • Size

    694KB

  • MD5

    ad35ef5346336bb9b2e0eedab376af8a

  • SHA1

    5ead65c1717d8fb67de14013f42be25729838d14

  • SHA256

    8a1aea514b658161770c47e07c649ee007937805cb5039bc90904bb85783dbff

  • SHA512

    9bd5fe22878b0b9ddf55109bb2cf2e359d2aacd93ec0fc1d0d1701796316c176705e91bd89b7590122fd0201ff6211235f3d1d68cbfb7f8948328711dd19d1b7

  • SSDEEP

    12288:Hl5nF8oVdqrlb9T5b+XKDl8lVBTMnd8fd/cqSbF5h/Lgse6q5g8goLg1vh3QjjyB:HlhqhbN5bWtJMn2dE5eh6qNLRjyFr

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2