Extracted

Extracted

• • Target
    FedEx Express_AWB102235516763.PDF.gz.exe
  • Size 643KB
  • SHA256 0d12d9fa2b9bb08bcc2da19f2d8cdbe704ff948b40e85a2d2f7e1ef75886a9c8
  • MD5 acce1b8742211d00d45038fc1e3dc48f
  • SHA1 b211cd4fc271cc12949e3bc1bdcf32741302df23
  • SHA512 50b3982985afa5b3c6ca90ee24ddaf33be1c1844f02f841145d6f5bb48079ab27aeb2cdaa9b8f6b8eb20677f742c6141d3dbfbf6cdda57ed3becf2996a824253
  • SSDEEP 12288:bZcUvsn1yCv0WV6p66i7wnpI9jhBwiSHVwusjjswosZMMtYwR1LSNkR:bMP0WEw7wnpI93vYwuosUZMMqTQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2