Extracted

Extracted

• • Target
    DHL Contract Rates Revision effective February 1st, 2024.bat.exe
  • Size 716KB
  • SHA256 21c842b3980ad1df3af813d4b0dc3200e1a82ba95bcc86e6961ce35a935cec01
  • MD5 95b155ae6087b1a1a6b6f680c029e447
  • SHA1 ac6a139e67281ce1affd80526e4fbc757abacc84
  • SHA512 4a515a2c74c28c8a17f6b9c7378c41a5f037b85ef2209639455f7422bd121e99627debe0c8f09c5983cbc5ece62cba1b1d159ddf129b107084c877256bf40920
  • SSDEEP 12288:Za1hIoIFFHgeg/cBix8x2VpLVRWdyMSfhtF+Zgt4wAv82BlXpPYQAgFmSq6eJW/:aIXFxp4LVRWwXfh+2t4JU2BNpPjAgcJE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2