Extracted

• • Target

    8190f821195f3047bdba44fb309dd111

  • Size

    240KB

  • MD5

    150845a95eb238bb0b72d9f9b7d31f63

  • SHA1

    a79813ed17faa8da9bed564957e7eda5cb49d5ea

  • SHA256

    854d167ff218c5caa012baaa7bb80a2bfdd1ec9c4c6b3a66bef57240ade29422

  • SHA512

    1f93fa80cefcf811549d280c0db7d7c9221d72fd4d387eacae321282a994d979db58c8d0ce8931fc1d9065aa63f961069042e0247302b650053216db4a5f3bcb

  Score

  10^/10

  smokeloaderbackdoortrojanagentteslaredlineinfostealerkeyloggerspywarestealer

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • AgentTesla Payload

    keyloggerstealer

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • JavaScript code in executable

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2