Extracted

• • Target

    Air waybill number 290132727 Physical weight 1 05 kg Seats 1.exe

  • Size

    300.3MB

  • MD5

    5868c50e2dc1435ef5c2c33ec04f70d1

  • SHA1

    970a43bb83cde2b80f5ddfa5157b6e5f9e3449c1

  • SHA256

    0963e88faac0d46f2bf382518aabb094fc9429d309e6eb7d18d4fa8c0f32d667

  • SHA512

    76ca95d5b222d8c53ea9a938039168f71e328b3b108187ff1e7fe11c5686978cfadd7919e53ece493384bdf4e8fd5fd924585abbd786c38ae63b9734c526e3b7

  • SSDEEP

    3072:s+LwLS2Vbqe+uZtuQ0UzDNwwh0wR2c2vGZ9pwPtV3vJPg1NXHII61gdZwgJRZ/2u:wEe+iXFBwhw0cvxwV3vaHIIiHFM

  Score

  10^/10

  agentteslapurecryptercollectiondownloaderkeyloggerloaderspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect PureCrypter injector

    loader

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2