Extracted

• • Target

    Factura de compra OI15996.exe

  • Size

    596KB

  • MD5

    e5fab9e269e47acd1d8bfd07d02345c9

  • SHA1

    04ddd959cd9da521fbd8fa91445e4998c70cfdc5

  • SHA256

    cf318e7aef171cb572926138ade9428424ce4cdf54be7c1c5d6af7668c52a560

  • SHA512

    7b1c549ee8502808353c00192dc5a057b2a7fb987a57585f4da1204ec2fb47aba74b53af500afb95d2b4e8eadcd323dcd9916bb06715da106b44613d3a3d2f2f

  • SSDEEP

    12288:CXe9PPlowWX0t6mOQwg1Qd15CcYk0We1FTdpp1GsTBkYPEbcZ0QKcV:XhloDX0XOf4BpWsV3gTkV

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2