Extracted

• • Target
    DHL PK 160612561677.exe
  • Size 581KB
  • SHA256 1e0970459d115bde0c455a543f92bac5f17bdbcaa716791704792c78be82f299
  • MD5 b9af2c2ded8d2511cb5bd4975e932436
  • SHA1 f52d4ea88b0ff0dcf0724238fae17038d581936a
  • SHA512 81c0cc530b28ff6ad1621203ddd426ad03a9e1794b2995e83bdf52f3fa35062fe3944c4ef9f118fec5f833c440278bf1888d7fb1976a1d9679b1f17f77060100
  • SSDEEP 12288:HA/Hc4BYvA8BEScDpkwU0/cIxx/MZrrb9Y+:Y9H8YWINxW9bW+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2