Extracted

• • Target

    SOA_SEVEN HILLS CARGO.bat

  • Size

    1010KB

  • MD5

    598a471dddb453d80036375fc9b8893e

  • SHA1

    7682286b446689b8f9f2d0b2c03554b13f03d396

  • SHA256

    348317a6cdde242d659ca060832df6ef808d24bb96d78d5ca3f58c50b7b6cce2

  • SHA512

    e7e1ac713dbdb6a06c0f6586c5700088ecbbdffa69befd221418830c8fd9218116c81b95181ec1b5c917f32abb10ce6bb6cb42c4936dca3e6d41422de4395e9a

  • SSDEEP

    24576:ot6fGhEePZQVxHJ3/DYfqBwX0nuKRY5AI9PpAVH8xP:KhtZQvltwXl95rprZ

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2