Extracted

• • Target

    Loadder.exe

  • Size

    98KB

  • MD5

    7ed8bf17132c1003da9e1fc473b1d0f7

  • SHA1

    e3d1754dbca2398977d0d1fb2b331168025da86c

  • SHA256

    e1c064d2472fffaff3b9566f473d5b43310d2643d0d98f364f81c6610e2ed0b5

  • SHA512

    cdaed8d1f7ddaa3a21c6a42ccca3b2881e562cfeffcd4bcc6f05b48581b138bf579bcdc38b0a71694a34cdc792686f7c8f3f51c7c5e6aca1370ae5ba034dacf9

  • SSDEEP

    1536:T7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIf9weLHlD/gap4KO8:P7DhdC6kzWypvaQ0FxyNTBf9xx/4W

  Score

  10^/10

  agentteslaxwormexecutionkeyloggerpersistenceratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • AgentTesla payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1