Extracted

• • Target

    Ship_Doc_18505.exe

  • Size

    419KB

  • MD5

    0833b3ea1e3d5c9fb6c81651d1208d94

  • SHA1

    297f2146c3a38eccfad04b35e150bf54dedd6eee

  • SHA256

    530e2499f47e4d6bca0afedb9b122fe60c7b619682467cd05d476003ddd93173

  • SHA512

    648039fc0313e486f84f7045b6092c0c4f2cca35d6e7b5399f993b0096c56398cccc989e279fe825f638d9203c541fbc7277e298d4c4fbbd58e9b82d3879fcb6

  • SSDEEP

    1536:t9ImCCCCCpCCCCCTdvCCCCCCCCCCC3CCCCCCCCfFIeCCCCCCCCCCCCCCCCSCCCC3:4CdsP6GBxhDCocvU/s

  Score

  10^/10

  discoverypersistenceagentteslacredential_accesskeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2