Extracted

• • Target

    RE Documents Attached for New Sea ShipmentNastah FCL20-21MIL238.exe

  • Size

    479KB

  • MD5

    93f9bb8926732cb022fa72bb582db052

  • SHA1

    7281ab92ccba4f0e290fb8e6b690fe1990d98fcb

  • SHA256

    f079220e1aba8003cb5f6af16d04d66f92a01feb0739bd4e9a3ffa9aa2d6b121

  • SHA512

    3c6335f9836df65eadd80203bd31a5c51a3a686d283a6f87dc933704b81e975e29c0962a0d7c96558e6576285e4340a30f2207e6d5d1ca4aa6afb4a48baea2ba

  • SSDEEP

    12288:bBZqfYHhutn4yXNs2KTd6rVaTddh/SNwyTw0/Qdlv:DqfYvMcTl/SNwPLv

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2