Extracted

• • Target
    Invoice & Packing list.exe
  • Size 613KB
  • SHA256 d37ac5f67be37a7cd0fa09b2d0ffb1e5190caf1abbb2183fd00b0c7a35a204b1
  • MD5 1e8668a8d9e3ecf5ccb2956932b7be7e
  • SHA1 c960768d1625a7f306067f64c0838cdadb8d213f
  • SHA512 0031a463a4b241db16cd318bccd7a64afb919a85295eb5245ebe303fa7b68778d3dcdfc33a01f8bad6f3f31ff0ef3471c573f1b4786522d8d13083e879cbc351
  • SSDEEP 12288:vBrepFFBP8tKVNbElq3k7uOuKJ9xiA0F2:Fep/Vhr3PA9xiA0F
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2