Extracted

• • Target

    3b254f8a4c56c1eb0e48ffbbcb1024149a009b4ec4123d913059e8038fa09183

  • Size

    332KB

  • MD5

    48fb8d3e38e1bcbee6398d2994764730

  • SHA1

    59af4f0dcf814ab16f35dfa27dec423fae56772c

  • SHA256

    3b254f8a4c56c1eb0e48ffbbcb1024149a009b4ec4123d913059e8038fa09183

  • SHA512

    2243ba06a132ced2d4188785fc9e02de1ccafc8fec479409bccace5ab4fa71ba84d28fd9defed9f9521e54d81dbcd34e8a12d1bad418b8c04a06e7f9783d9cb6

  • SSDEEP

    6144:3fL+oq6sq12PAjvjHSPMW3JB68oZmaYtJ7lbwum:3fLDsqI+jSPLoZBP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    ⠨/start.vbs

  • Size

    173B

  • MD5

    2fd98bad7e3e521d8a67acfa4a681a86

  • SHA1

    545fd01deb3a8cc9f605aa33ea2b060e9b904c5b

  • SHA256

    aa1ed4fef63aad3ca2461ab76ab18890bffb7554100bee65dd7665b213c25706

  • SHA512

    3aafad51333b06e31d4c6965f1b2d81f4e7d5ebd7334bec2ebbe648930154dfc34848d96a4cd27a43e3d709a0b4a24eb3d3bf77d91c10733975f9e95a24f44c8

  Score

  1^/10
  behavioral3behavioral4

• • Target

    ⠨/temp.bat

  • Size

    277KB

  • MD5

    8b4e4571f1b43434f6ed2b668dddf598

  • SHA1

    4b7cbd44f9dbdf4e7297fd10a13c587dad3541a2

  • SHA256

    ba51fc7d4bd3f667bf018b96e2afd34dc18e766839b2e3a5cf4232f6c34ff7bb

  • SHA512

    10089e93684e5131576107933d11cf6107ea44a705d04a52d2513d16ab3cc209b15b00c15cfc1abb93965def900cfce8ddc42d8e157e4f0bc4d7dc98fd1c40be

  • SSDEEP

    6144:XmbWmkSg3ie98f+qE61saQyBJz/y2V2c1Otv7cvSEOOovdg:7bSgie98GO1saQyBJzh2c1YJEO3Vg

  Score

  1^/10
  behavioral5behavioral6