Extracted

Extracted

• • Target
    DHL Waybill & Shipping Documents.exe
  • Size 662KB
  • SHA256 c1554b4539b962eeeb79e84058197827abae4cad2dbf81e5055f7c9259bb3584
  • MD5 ef19305834003a5157fe1f860e9351d6
  • SHA1 8cc11ce9c5164f2dbd13cd596e6247b8a7f590e9
  • SHA512 a79888029b42ed0f53d878c8557c75add3bdd85fdee7f41e9293c463c40377329323c4bef5cb14853458a1cf1611b74e36a73c4c442e1d8c5cecf9f7a1a0ab2d
  • SSDEEP 12288:A33bBYlH97aC9Emn86WHHP8vy+vxSf4hBbWJIHC3vhLTNHWNi6hm4uLykR:43uld7aCamn86WHI9Qf4HbWaUpNHcrhe
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2