Extracted

• • Target
    DHL Receipt.exe
  • Size 575KB
  • SHA256 8150ceb72ebe958ee0424f42b26eb134281f42e7188a9f08ccc5025ac70bae24
  • MD5 81356e10d2160bc08505a91159011453
  • SHA1 87fc1b2a4aca70c7c2e4da17ba08aa6a6d3ca716
  • SHA512 4ad3614df456b0092f8a9363cbd9f9994d673a96aa37663049aef9bdc4aec854b44c7eac731a215def89304216790b934cc407efe01d6f4799b356e704f7cedf
  • SSDEEP 6144:16K+WbG7MRynQu82dBmpIea1KlPUhFigp+Vk+7wEuQeHMzw85M5678FM6Qz6JgGz:n+w10BmEEloU95ww+6u6wFM6AQEi
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2