Extracted

Extracted

• • Target

    New_Order#3240ZA00J.pdf..scr

  • Size

    735KB

  • MD5

    a57e678370efec8e12378483d7a8bb65

  • SHA1

    e42115dd86ca57c8987b715f1e95394f69ed705f

  • SHA256

    c362f1e7aa389bebad78334a12b8ccf70b5d21e03c98be7c36cf7444ac7f58ad

  • SHA512

    219bec3bc3fe6b45c2221d49982313b1549ce02b8d88cb76afb9eac294ce7a907e96fb9aea206f1faa3af04aadcb437cac136e5ed45e9a60a7b25efd6720dcd0

  • SSDEEP

    12288:m0YhgVVNlqH1vVnD7JoHil6NrewtMoEHat0MBGAkA+tnI3H07SBctB4PeNj:C4HMVD1EuwSb6KMBGAkAmndm6yPeN

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2