Extracted

• • Target

    shipping documents.exe

  • Size

    795KB

  • MD5

    7805fa9669d8eee949ec8ae59ab595f0

  • SHA1

    69dcb0498aaf2176629a4d516056e95ede493b8c

  • SHA256

    637e96ec91a77bc1a8bd1b8ff7f0fc027ce9c6ad579980ad7bda632cf500a3d8

  • SHA512

    8ee5fe77a2e415848440acad2d11decca6b8a8e46de89cf7a865b3c9774d072a8bb01fdc81296fe894124c940181c741f9cdb3c33da938a404c07f9630780c81

  • SSDEEP

    24576:tthEVaPqLqx/VZSJRoQKl4+qxwzZdeP8XQs:VEVUcq3ZKRYl4+iUXQs

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2