Extracted

• • Target

    Order Inquiry for new Purchase_pdf.exe

  • Size

    947KB

  • MD5

    12a0d4a27fb7f7d5f1b345c9e6b171e2

  • SHA1

    6c6c01b4d9023e2f77ea6758b935c656637e5ea2

  • SHA256

    fc44d6c0bc3f20d6e311cbc63e3442fb7f31b2edf039e49ce424549eddfa522d

  • SHA512

    1916f25fd5dca34c3c92c97a0a5ccd9663d1bdce3d00ee23fd5c1dcdc91784fcdba8fb4857c0478f95920f0c9bbe9e422effa2163e724af4343f6c7ae6dd4418

  • SSDEEP

    24576:OeqkD+B877zBtMA0yZqv+D09Pxjlahm8QIPntPG1kYWAXPJ:OeX+xjz8HzYW

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables packed with 9Rays.Net Spices.Net Obfuscator.

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2