Extracted

Extracted

• • Target
    DHL Receipt_AWB#6355646657577514374654-pdf.exe
  • Size 709KB
  • SHA256 3fd5a88e512d91beaceed5571becb76d25c2563be4195addb288f827652dd03d
  • MD5 69fe24e852b0c12ce3f57235580cd196
  • SHA1 2de4dbd99d3705a9a3af49ec047bee874a475c36
  • SHA512 ff42fc08ac0d225efba4f2612fdf5623d5ff8ebc7fb20dbb77aa3b303e42a409336c2f3834e3fa7865498af300a858982d63ea73da02889d36e1d14840b09805
  • SSDEEP 12288:8Yd53rD22TAufyQOpQiy4ZKsgYWmYry8VbZCh56GArVm/LF8j7VJkkmLA:7rDWcyPzcrHd656vmDFW8kmL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2