Extracted

• • Target
    25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f
  • Size 758KB
  • SHA256 25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f
  • MD5 fc40ced35443bb1e6e7c04f982707aec
  • SHA1 5e11965ac4942e69ef646014056f2a7bf42d608a
  • SHA512 21f16b8761ecb0707c6aa5609ba19741ecb4972783786d7a9a09c05b0b629031ac1156a66aca8c44db91b00cf7ea1061a170670acac356908951da24806ced02
  • SSDEEP 12288:5qwKVI2AFDaJkVTJheA402+491tY/grOpzVbyNdVIHQrAr6ANHCzLDbDW7aEsy:V81AtrBv402rm/Xp5bgHSQrAWANizjqN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  executionagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/Banner.dll
  • Size 4KB
  • SHA256 e5a0972609366a4fe74d7bb69f7c5599e88a302e77eb5abd7eb653b8133f1a4c
  • MD5 d51eece665b6b520e69c76dcf3fd13d1
  • SHA1 ef725348a4bd3941eb3a21d8049dc19fa5daa14e
  • SHA512 cd68a91f907e901c1f3f4b7a2351fac4d33a17562b6e80dda75832ce970242d19fd42cf3c362db238c66f6dc5a8c6a8f144b04ff3286436d0ba8d0a2e3e513c3
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/BgImage.dll
  • Size 7KB
  • SHA256 27d3e3e359e1e04b173277221055d043e2f3baaf78a5d6f7e3a0a5dfcb96222c
  • MD5 5da88848798426643f9810237b58937d
  • SHA1 e1830dca870437116b93decba8d0ba81f1056d65
  • SHA512 859d0fef023b6fb9c41589e4aa5bcfc23259639aaad2fb51e1304725d6e28852bd6b6a68ffca8c6a20adae4d735e6a03620890036ed57095f40318804153f586
  • SSDEEP 96:8e3k1LFJaO1/radJEaYtv1Zs4lkL8y3A2EN8Cmy3uTF4j7J3kWyy/:t0TJa2roqJyA2EN8diuTSje
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5behavioral6
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 aedb5122c12037bcf5c79c2197d1474e759cf47c67c37cdb21cf27428854a55b
  • MD5 d6c3dd680c6467d07d730255d0ee5d87
  • SHA1 57e7a1d142032652256291b8ed2703b3dc1dfa9b
  • SHA512 c28613d6d91c1f1f7951116f114da1c49e5f4994c855e522930bb4a8bdd73f12cadf1c6dcb84fc8d9f983ec60a40ac39522d3f86695e17ec88da4bd91c7b6a51
  • SSDEEP 192:oWa8cSzvTyl4tgi8pPjQM0PuAg0YNyZIFtSP:DaBSzm+t18pZ0WAg0RZIFg
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral7behavioral8
• • Target
    Tinderous176/Dialogistic.bat
  • Size 2KB
  • SHA256 787c534d744738dac489dc75acb2e639f73ab5fffcf7ddc0046e947f6c35f7bb
  • MD5 12f0273bbd0e4b0989af7e3b43c2ec41
  • SHA1 6f615e38df1e3048b9cd0ad6eff13f729048f229
  • SHA512 b306c8be0e1cfe3d6236bea50612aa419816e7899330faa0d189d2ac520946c9a81c88f060ad72a5613a25c3d7bb06d94f8de9dc485ff5065aaeff9baf4cace2
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral10behavioral9