Extracted

• • Target

    RejectedShippingDocumentscompiledPLpdf.exe

  • Size

    1019KB

  • MD5

    e2c463c453c436adbf05e5f767e976b5

  • SHA1

    27f01c17e41b49f3a77550a1a8e1c07a60b8bbfe

  • SHA256

    1901fefcf83a2db8d2e4a717e382df0bdf8db7e7f48615bdc9a26b45f0b7c0ff

  • SHA512

    32cb8b333ab384e113ad6ca3aa6e4c4bb2389834fe4790c5a2aea2bebf295c8716c8660497c808a8b4d4b586ed5db972948693a5d28865275d87a27c022efcc6

  • SSDEEP

    24576:UAHnh+eWsN3skA4RV1Hom2KXMmHahCrTAUJjY5:jh+ZkldoPK8Yahc0

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2