Extracted

• • Target
    DHL NOTIFICATION.bin
  • Size 513KB
  • SHA256 e7ccbe9dfaa198263b85336d9f89a775f7601070708ce65b9e4612332e0207b8
  • MD5 67f9178be5fd199970c27c2264e85227
  • SHA1 840cffe1d7e9b7ea17bf050139d2ea3c62ec9c3a
  • SHA512 51749b297ac4cdc11c45ebb1f206ede83c767e627e5f2b9aa0aae40c38aa7e6b550f03cfc49ed43f28945fa0d08fa02a45dd5cf35461d5c10f2440693106151e
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2