Extracted

Extracted

• • Target
    DHL Shipment - AWB 3734166170.exe
  • Size 691KB
  • SHA256 ae16694e0640bfcb3d53389a2a11f459066625d9cfaf982a79b2bda3a26e97b6
  • MD5 fa93706769731092b081161567e8f873
  • SHA1 b0b228e24f4d51144cdbc2509b92ce0b8311349b
  • SHA512 67408a2e67f5bb0a88a222bf4381f8fbc83d214d9eeca0914e903bcaf49c2b1ccf1bd1e439508978ad28c5e526014d1f09f5dead1cbbb4a499f253103d160368
  • SSDEEP 12288:cOmRzntneLAfAaOMCQTLPT4fhZLhj2xnU5glMeB+og7PPrIeaV9:E9ntn5oMCQnT4fhZLx2xU5gqvog78J/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2