Extracted

• • Target

    Great Wall Motor Sale Bank_Sift_Copy.Pdf.exe

  • Size

    1.2MB

  • MD5

    2884d53826b824a28cfbc4ebefabf549

  • SHA1

    6968dbd0d1cedf3bdba126eb784974cbc0e4d2bd

  • SHA256

    1a0c97c25e5ff8c862717d45f566659b76014262e3f8aa2867683f6f62af9be0

  • SHA512

    3e6e5de3b0b36f4d3ca4a33193077706038d1bbaeb6fb1a0a6c4a40af501b814ce261a0f7fc4ac321680bc615eda459b09f4540f47a8ecec2fe2e8af2c04ff80

  • SSDEEP

    24576:ZZj9DS5AM4OF+PMwrSVlbmfDYkhDvGtjXtGUAF9kJ7MqudghfEuCj0hThiHHxlhs:ZZ4Mw7nx

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2