Extracted

• • Target

    shippingdocuments.exe.bin

  • Size

    463KB

  • MD5

    1572bb732795b09ce8469e615ffb010d

  • SHA1

    ccfa832de9028ab78dd2d9554e8b8d95b275bc9c

  • SHA256

    858d78e45567e3b39affd12795d7b16fbc9af5d725ee7a0dffc10a86ca22133d

  • SHA512

    581e68da17ed09656d5e522e5ff7f8507885eff7975c4a6177df21d9e27162704dd02e55beb62f056fd6cfaa0229996ed99e4aee99cb72bbaf3c0c42c324825b

  • SSDEEP

    12288:l7cfm2Ib++4UWomGiUjcI0tlgx21XfR8d6:lQObH4rdNI0K2hfS6

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojanredlineinfostealer

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2