Extracted

• • Target
    SHIPPING DOCS..exe
  • Size 600KB
  • SHA256 c822aa53c6e49a7aa3e32869936583cd7308a414974d76b9bdd196908befbc16
  • MD5 903d1b3aaf8dfb1d28919df311cd980e
  • SHA1 8e73fb005646fff8677a3cead94b833087979ece
  • SHA512 1871ff2d8d34cf410bc400732aa896271d1d25dafa0b94a3302da8ce9aeb9c0a167b374c24333639f3833262bcc58ad76c04f66874cc4d37d4890843fb7546c8
  • SSDEEP 12288:/pB8++rCfLR5v7uMcZg4GACUp2ZT4T8VIVowbdE/ko6:MRrCDRhixm7UptTwIV5To6
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2