Extracted

• • Target

    Pago Transferencias 7821330877.exe

  • Size

    802KB

  • MD5

    c98a5eeb0b442feef1b8d967c396277d

  • SHA1

    40b940bad5f21625427ce988fb9c086f95f6b0e2

  • SHA256

    717374926f2d2a078ef2a541497ce30e7a0283add5b111251ec8a41ecd200bb2

  • SHA512

    e3b1b75cb79ee42ef2c54b2ce2b543aeab8f529c66d8eda063dbab83238658244ab8d532c015cc0a15a9eccd390e8818e5030fdd72b05c8302222143990229c0

  • SSDEEP

    12288:51nnU0REibppIBDPM6ysl7tQg9uK+z7oXZGwBQv4qbmDq/+FxwRty354yh:Tnfrb3IBLWmtF9u1cfWvNh/katyp4o

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    12KB

  • MD5

    acd12e950b2ced1b5690f682d2c15b25

  • SHA1

    639a1d0aaf669896377074281186cb6372811fd6

  • SHA256

    6a28f1529bd59bc04f0519e086d2946ec4f09f5e4e6f30d2afb3c3585001dccf

  • SHA512

    131bd07208d2d8c18ee9da36ce95e3c4a8d8acbb55fa96fc5a0affbc1d6e6b0ca733e9dd70ef1d5a0e15f91d88dbe1fe2c0656ea80b5a51e536ac54ab53110b4

  • SSDEEP

    192:qA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:+R7SrtTv53tdtTgwF4SQbGPX36wJMw

  Score

  3^/10
  behavioral3behavioral4

• • Target

    Indrejser/Blewits/Gonadic131.pot

  • Size

    35KB

  • MD5

    2f5f902edfecac3a9d4116df30075d69

  • SHA1

    416fa1751926a7b755b8ad5fbeb72a5e98e8deb2

  • SHA256

    6c301208b1202c52ce208546d634a55c5e58b4515bee44c11f377f2d6a931fc8

  • SHA512

    e8b13a13e548f142186b0ae81601d7bd1dedd0a6d1e4af30e477edae6880721e90e8256e2d0cbce5478a1bb3602c6169e09ebd872f7663a7d81e709a9c6d8984

  • SSDEEP

    768:HpRboDcBs+WIpxtRQfCJM2I/rg8AT5uin0:fqfiefx/MQ

  Score

  1^/10
  behavioral5behavioral6