Extracted

• • Target

    Maersk Line Bill of lading_invoice018.doc

  • Size

    47KB

  • MD5

    f56b241fc782c9f48c07f4250fdc07ea

  • SHA1

    0f6fdab4d9906867867c278a52bc249cd243f710

  • SHA256

    4b9015eb413a5c3900836fef95d16ff8b32e36a929851b42d037e79ddcf282b9

  • SHA512

    39305a76b20b462078a1e0f8e1996f3a6faa98f8f8b0f79a00bc29269077463d8e83c5cb9659a770539557329ff5857f9c0cfa39a4989f4145a15864a225ba01

  • SSDEEP

    768:UFx0XaIsnPRIa4fwJMSiedKxniwNHm9h7Bbr6KKoyN/u5u1xd4/sXK:Uf0Xvx3EM+UxnJNHehFLvA/OyDaMK

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2