Extracted

Extracted

• • Target
    DHL_VTER000105453.exe
  • Size 696KB
  • SHA256 0144ad3c79e25335ba0bb88e4c47c497215af9d44f0dc9f8a550bf71d579ca07
  • MD5 7dec2c3596f3081f16fb71af0b1340ef
  • SHA1 2f95bb30d3d11e88713b66fe1c55113e06890656
  • SHA512 99b383bc464f37fc5b5a8cf3e8415360e9eca70df7358fec3a2e17b045e8d928042a32ca89504ee460048e28f044efda00ef882264fdf4010c318a3a81fe8a53
  • SSDEEP 12288:uVUL2iNdl0ZE1huYAo+eovnS+P1R+5DH2qhu1zbCxjLqsewT8Nu/+SyST3xT1O1V:u+1Pl0GDADZvFPD+tHlAoJewINI+SySq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2