Extracted

• • Target

    dhl_address_form.exe

  • Size

    700KB

  • MD5

    2609ae8c66f7d758472da101042c3548

  • SHA1

    c787a4d4d919399f7041839d21a620a2d51fd5c4

  • SHA256

    e356d7e8758967daa9f5d129eef727202e2c48d2808355924cf247aebc1bd336

  • SHA512

    0776dbf3a2b0de4e760b12ccd896ebdb25018ec5f8072b3e4c1ec5fbe8a3351ccae5a7c0beaa08feda571dff15c0690b7c132b95b523d6451ce7eb1a5d64d28f

  • SSDEEP

    6144:kE/gzZZ0mSLAkBTsvgYoxBAosUXBQsnJ/vY3ZFbvC2BoaaVAcL7n:k3zZZ0mXWTsoYoxZsUXBQCo3XK3VAcX

  Score

  10^/10

  agentteslacollectiondefense_evasiondiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • System Binary Proxy Execution: InstallUtil

    Abuse InstallUtil to proxy execution of malicious code.

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2