Extracted

• • Target

    New Order RFQ- 19A20060.exe

  • Size

    3.3MB

  • MD5

    37bbc0a6a399418331028aab64f4934b

  • SHA1

    ab202974d765cd711cdb1174e06703e3e7f8f6fb

  • SHA256

    ed70bf326cea089f65ec4d96d7874d8cb65f5ae5bb12bb66ff0e9f6b4bde78ee

  • SHA512

    b9f170fe33ec79f6a4c9f0b01a0536a67cf4037957ae26a0523e461091f1cb7341b8f89ba8da46e189c1084503b854f8804dc230e844b6b5c50e4b132c740882

  • SSDEEP

    24576:HQ2UiVzd4oKzRpnOQGOvP6Lryocw1N/qMJ:H+iVJ4oKnCr/d

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2