Extracted

• • Target

    shipping documents.exe

  • Size

    810KB

  • MD5

    c5516ff1d3704bad31059e7d7ca7cfe7

  • SHA1

    9eed578b0fc8ad2e4083b6b226cc1e3f4a04e42c

  • SHA256

    fd67c185be66d7cbd57f97cc05892e93e9e134ff930ae479ac17c726c74cd8d6

  • SHA512

    b5672accd8255ef79570e3db355649bd6472547353d0a89aad2dafe0bc2cc5926d272c4ae988e368cde1acc40abd9fc2f42a60363b10e1a40e29ea6648025196

  • SSDEEP

    24576:tthEVaPqLIjmzLLzevg1tN39mWwqxWj6I:VEVUcp/n9oWdWj9

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2