Extracted

• • Target

    Comprovativo...exe

  • Size

    419KB

  • MD5

    eddd297b2c76605d43ad789f9df03227

  • SHA1

    e96b8968ba54658b1a87cf2dea36d6f08c59d68d

  • SHA256

    33833fdf7cdad539e1c5dd23ef7c73daad266821cab91abad9189f00c2aafb9f

  • SHA512

    b00b10feeb79be55e8759cce31224c58c48be00d8a7f0c4ac8a938fde6f44350da98672d46e1c17b25cdcbc3778bb55ae109abda3ed395aa9528b61b65619bf9

  • SSDEEP

    6144:/9X0GEh9EyWfqG2ts8KYV/i43TsgyT4O/f/KNGCZErCYatEv3F5SzLg:J0VEsvPZG/XUGvCYaro

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    34442e1e0c2870341df55e1b7b3cccdc

  • SHA1

    99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c

  • SHA256

    269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1

  • SHA512

    4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51

  • SSDEEP

    192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4

  Score

  3^/10
  behavioral3behavioral4

• • Target

    $PLUGINSDIR/nsExec.dll

  • Size

    6KB

  • MD5

    ac0f93b2dec82e9579bff14c8572a6c8

  • SHA1

    6460244317cbb77e342adb3561ec3acb496c84d5

  • SHA256

    3aa8e0abadefea2de58281198acfe48713a1d5b43aea5619f563cea098e9fd34

  • SHA512

    8055a6af150c45547927499f9cbf645d7f39c8e4f9caff4726fd711d2401abca01a79837095e5752b9f57b06446973ea6506796f2223bdb0179243d6e0575bd2

  • SSDEEP

    96:5OBtEB2flLkatAthPZJoi9jpfW/er6cBbcB/NFyVOHd0+u3wEX:5hB2flXAVJtjf6cBbcB/N8Ved0PJ

  Score

  3^/10
  behavioral5behavioral6