Extracted

• • Target
    FW CMA SHZ Freight invoice CHN1080769.exe
  • Size 811KB
  • SHA256 8b3c86cb96e0bc77cd80fd68892694cd7f3d899462b2398588c9aa4dc9828ae8
  • MD5 618d7fddd76b843f83d6d4c31839b5e7
  • SHA1 ef36abd8aab3d7fb3f6e7952eded55f8e250f9bd
  • SHA512 ee7b04ca41683d5625439456f0c1945d12f2fe566d6a29e8969b901d8c7a490cbf14c6525470771941832db3b3b57c22a9966eaf2b24988106252620532d95b4
  • SSDEEP 24576:zjj0ywkp58986ZL7WwXjygOj9gLEwaGihzyI5:nwywb986ZnWwGHePaGazB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacredential_accessdiscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2