Extracted

Extracted

• • Target
    DHL SHIPPING INVOICE.pdf.exe
  • Size 610KB
  • SHA256 6e4abc6a114b9b50936426d9eba916fe2a4fa59e9e226ce1c369ffb092d8087d
  • MD5 bcc0b41935f136c8b9fb70e802e9e5ed
  • SHA1 adb5d45027481c53c24206fe231e4352d262a0ae
  • SHA512 a95caeaee41365814e66e959fe21d7cfb0c6e8570dd427c9923068b4e0e60d4f75529395909478da2e8f080331bd2d9eaa439268c47277c02038d44eb4d2efe9
  • SSDEEP 12288:3U3YPJASnwPbU7wwkrBzHxd8+1yy3+3qHiNJ0GzCAQ2G6MIsAcBdVQyTzvvF:3JPFMw0vygsNiGnQbjd+yTTd
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2