Extracted

• • Target

    DHL STATEMENT OF ACCOUNT.exe

  • Size

    1.0MB

  • MD5

    c54f3b3449c4acd5f2bb25b2f1276a1b

  • SHA1

    38315e598c862e19e98f1a1e83f7840911c74fef

  • SHA256

    2abc61cc5afd3fdebd60f002c625b1a7c81755f5a9ca5aedd8daa13f6b78b996

  • SHA512

    eb3c5d5576280d3ba2a885e6c59ed54c68e3234eddb44000cff76f07efd244e047c7f82eab0080e27746812a476ab7e053c713b660a4920a965dbcd1ada68fe6

  • SSDEEP

    24576:CAHnh+eWsN3skA4RV1Hom2KXMmHamSJ93YBZsNEox5:Fh+ZkldoPK8YamSJ1WZhy

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2