Extracted

• • Target
    DHL Receipt_AWB811470484778.exe
  • Size 702KB
  • SHA256 bda33bc9b97786bbb80b49d0d17ad8454b0a66f23b380aa5ecae68f86ba6cf8a
  • MD5 cc20801ea97b48cbc88b511866338f27
  • SHA1 835bf2ccbcd3c3e828d48f7c8bbee3be92903d46
  • SHA512 a4a8331c61f08cd827359c5b28f37554d4a7dbef2b897a30f7fccde2e05efd5908b30e7522e489ae2c5603dad48232218f9a9dc9c290dd86cefdfe7148e19ccd
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2