Extracted

• • Target
    83ff8817ce686209e0a3a63afb62ee80a662f33a3e465eea8a05e85573f727d7.exe
  • Size 482KB
  • SHA256 83ff8817ce686209e0a3a63afb62ee80a662f33a3e465eea8a05e85573f727d7
  • MD5 a5d5a31f1cb8107cf72aefe172b1a3ac
  • SHA1 0b3ea3475d8892bcf07e2268c22455c684f0d06b
  • SHA512 723e05e115e6bcb5da04a0eb93710d8d53498443861e835adb6ed5f2ad94e7847862bd90dc9cba3886402f790f94a9c4cf194a9a2880999dd0f6739befb23208
  • SSDEEP 12288:/LkwkkHkkkDkkqkykkkkkkbkkkkkkkkkkkqkkfkPkgkkkkk9kkkk3ukkkk4khP0e:TkfkFB1BrY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 fda0018ab182ac6025d2fc9a2efcce3745d1da21ce5141859f8286cf319a52ce
  • MD5 4d3b19a81bd51f8ce44b93643a4e3a99
  • SHA1 35f8b00e85577b014080df98bd2c378351d9b3e9
  • SHA512 b2ba9c961c0e1617f802990587a9000979ab5cc493ae2f8ca852eb43eeaf24916b0b29057dbff7d41a1797dfb2dce3db41990e8639b8f205771dbec3fd80f622
  • SSDEEP 192:BPtkumJX7zB22kGwfy0mtVgkCPOse1un:u702k5qpdseQn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsExec.dll
  • Size 6KB
  • SHA256 1c2f19e57dc72587aa00800a498c5f581b7d6761dc13b24bcf287ea7bd5ca2bf
  • MD5 3eb4cd50dcb9f5981f5408578cb7fb70
  • SHA1 13b38cc104ba6ee22dc4dfa6e480e36587f4bc71
  • SHA512 5a0c9d28df7a77e157046dce876282c48f434a441ee34e12b88f55be31be536eff676f580adbe4586da3f1519f94b5793ccbb3068b4b009eee286c0c5135d324
  • SSDEEP 96:+7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNv3e:QXhHR0aTQN4gRHdMqJVgNG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral5behavioral6