Extracted

Extracted

• • Target
    PO-001.exe
  • Size 623KB
  • SHA256 6a861eb0176a0f7e0c4d69f2a65856d739bd4829448e72add40fabb9bf439634
  • MD5 5c18ec65c8c26f3757e9d19cc7f37fc3
  • SHA1 ace21507a35a9db273a704cfa741c606bb4f166d
  • SHA512 b460fed22286b245e9558be50161dd5eca79096cd91bcf88467695f804f0f2c9ba956ba1a406d6502d73ea9914d43aeff0fc1ae0f842dbafbfe83ee84e22c5d9
  • SSDEEP 12288:NYsmTCSUa1J3kR77kWX2h0hChIep9sO73QV4hdts2tCSgu:NY8SX1J3kVkv0hCvb3dtsIbgu
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
  • MD5 cff85c549d536f651d4fb8387f1976f2
  • SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
  • SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
  • SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral3behavioral4