Extracted

• • Target

    DHL 08102020 0013456 09876.exe

  • Size

    770KB

  • MD5

    7ba4cbfd2c65ee56f79122c087a5cb3d

  • SHA1

    b0952fe773b43850742bf8ca0e7e69b87e4042de

  • SHA256

    1eb80076d32a7919086f64f0fd8bbb87f2116992719c9d67e679f3c76a2e9392

  • SHA512

    d6695512546c6e77d40e4a25b76dd79f50323ee5dc3cda24f149b74d07ca2fd1f4dc1795e738d6b137ae311104a6fbb79811676db13d7f902b6a7c9de680067d

  • SSDEEP

    12288:1jR4XZUNvv1y6kU2KMn9226/Zz0zIdKBxq9grpiAeve/ckjQc:X4pXU0n426ByIdKyCQAev5kjB

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2