Extracted

• • Target

    Remittance advice.exe

  • Size

    573KB

  • MD5

    910da75d1c40740e17a0ab0b3eb14cf1

  • SHA1

    42461054f817eaa161787deda99bb3455ed959c7

  • SHA256

    815f7166e2d4007e6181aef6e1f7c82a320dfb3b84a610a065db6a3cf8982873

  • SHA512

    491d75253e91e2487e8cfdbd7309fee4a13c5641c7d12d739ee23b16b3b6510bb043a79e2a8bbfcba8716aa7244fa675074973cdf5f72dd8daf837c6a7debe6d

  • SSDEEP

    12288:cXe9PPlowWX0t6mOQwg1Qd15CcYk0We1FxnU4xZdmWx/P8mfVt3D34PIF:5hloDX0XOf4HZI+8QVtz34wF

  Score

  10^/10

  discoveryupxagentteslacredential_accesskeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2