Extracted

• • Target

    CONG TY TNHH RAISING VIETNAM - USD 5850.00pdf.exe

  • Size

    1.2MB

  • MD5

    bf18b7e885f313bb968e77db5211253f

  • SHA1

    cef69c725141d46d3223de5240aceda86b641b57

  • SHA256

    46ec294043413ecec9c6a8fa2c8a70d99abdc0d00003b6d31d795a76e50c7a60

  • SHA512

    e8876eea97e98098ea0ad57825b258c698168ce5e0d08bbf094521444a15cf720ed5797db281ef868f8d0f439683436db3a93064bf2558de0d230920f6bd5173

  • SSDEEP

    24576:NJ+1xwtAQSl/+1+LqxbmSrMixFawpA8W8:NUmolE7xbmCFSn8

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2