Extracted

Extracted

• • Target
    6ca4ea56e41a8e70a6f00be6e96ec688
  • Size 412KB
  • SHA256 ab3722d5df5b9c175bb8e2992895ffb9b2ce317fd3b1e8f49a10b7433ee5a17e
  • MD5 6ca4ea56e41a8e70a6f00be6e96ec688
  • SHA1 f1b498376efdc7a5cf12cc8ed11f2274da8bfab0
  • SHA512 e44fdd63618bc7d38dfbda492db21bed4e0be92cba8d11a66be67a0bcca5aef6e6b475c8cdfd13c6a8ace3ddf3c3eae5f647b74f8036c687a9ab383d4b20d965
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslawarzoneratcollectioninfostealerkeyloggerpersistenceratspywarestealersuricatatrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • suricata: ET MALWARE Possible Dridex Download URI Struct with no referer

    suricata: ET MALWARE Possible Dridex Download URI Struct with no referer

    suricata

  • suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016

    suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016

    suricata

  • AgentTesla Payload

  • Warzone RAT Payload

    rat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Sets DLL path for service in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2