Extracted

• • Target
    COACH MARCH ORDER +COACH JUNE, JULY, AUGUST ORDER .xlsx.exe
  • Size 558KB
  • SHA256 8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b
  • MD5 eef80ad0744688be6c6029e7793dcf91
  • SHA1 35c0251531d08a060807c429e0833b5d48099a9d
  • SHA512 ed28dbb5861aa55f64a0ff08851df3419275c780bc215a5821d08a49c5f1ccc16b0d7ba635f9394b467a48caef841101254dc8982bd0b28b0a3bdcc661bc870c
  • SSDEEP 12288:EMwrhdMp7SyAHZ5lEhugESlldjfmj/IiZY4CqXr6pSD8gZLI:EMwr0p7STUE6+jdm9qb/8gZI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
  • MD5 6e55a6e7c3fdbd244042eb15cb1ec739
  • SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
  • SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
  • SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral3behavioral4