Extracted

Extracted

• • Target
    Comunicado Cierre anual 2023 DHL GLOBAL.exe
  • Size 748KB
  • SHA256 cdf6ae802390cefc6f276f7d0b8577d1befbc25b8e912e634e16027d6f520d04
  • MD5 b659114c7cc72195ec1af895afe3d03a
  • SHA1 585f5e4b70ad8bd4ef004079d6008d8f8bd97d66
  • SHA512 e39b1c147c8cc9130cb5f762377df448fa93b54fb768ef148adf892d25f18b8cedd0766f686625849aa8a15e75016ed76bae1caac9ee08834706307f1d3fae45
  • SSDEEP 12288:qeEnQmbCpQIIcQ3XzwoPjahExtNGdZRqcMr+XpbDeQMgBy3Qhw0mqAbe:iICXznPjcCEfq+XFyQMl3Qxmq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2