Extracted

• • Target

    8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b.exe

  • Size

    558KB

  • MD5

    eef80ad0744688be6c6029e7793dcf91

  • SHA1

    35c0251531d08a060807c429e0833b5d48099a9d

  • SHA256

    8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b

  • SHA512

    ed28dbb5861aa55f64a0ff08851df3419275c780bc215a5821d08a49c5f1ccc16b0d7ba635f9394b467a48caef841101254dc8982bd0b28b0a3bdcc661bc870c

  • SSDEEP

    12288:EMwrhdMp7SyAHZ5lEhugESlldjfmj/IiZY4CqXr6pSD8gZLI:EMwr0p7STUE6+jdm9qb/8gZI

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    12KB

  • MD5

    6e55a6e7c3fdbd244042eb15cb1ec739

  • SHA1

    070ea80e2192abc42f358d47b276990b5fa285a9

  • SHA256

    acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506

  • SHA512

    2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35

  • SSDEEP

    192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL

  Score

  3^/10
  behavioral3behavioral4