Extracted

• • Target
    Order 00039940002334.bat
  • Size 636KB
  • SHA256 0d23bf28abf8f91db828692cc71ca22209fe7c51b03589ec3f5764447afac870
  • MD5 7ca776ddbee100da26a49324e75b1ec2
  • SHA1 008b80db56e8a8cd518b7083cdb0c3851e48e148
  • SHA512 2cc08b606d63021f1c43a8e023bb604128f7d9bec7f8efb815fabde2f8465a7b531706bfe2a3811148602a89eb59e5c9cf981d387d52d698e770fe1cea5c2e51
  • SSDEEP 12288:f8oTmXIyxSiWeSvlFYoX0XnU6IAEy9UhK+8TAQ5+rROXP:EoTWIe6Yo8U6kyK104If
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
  • MD5 b0c77267f13b2f87c084fd86ef51ccfc
  • SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
  • SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
  • SSDEEP 192:4PtkiQJr7jHYT87RfwXQ6YSYtOuVDi7IsFW14Ll8CO:H78TQIgGCDp14LGC
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral4behavioral5behavioral6
• • Target
    Granske.App
  • Size 172KB
  • SHA256 4714b51a71661da35eea60d116ad8f19e7cf8055208d56f6c1b1854c38b8e4fb
  • MD5 5b3e6e7c3929c14e4cb08ae96d1d2d4e
  • SHA1 517ddba7fa02d373204bac62001c7a6822edee38
  • SHA512 f1f5c746965c8f06406b0b6224cf4661db6ae68e7d6c33e9bbfbe5264c4a21a5702f80fad2c8003f275ab77041be31090dfa3b4d4bd54b7ad4247d4df772745d
  • SSDEEP 3072:aZ/peI3AA1QvQEl2IKD9f/EhulOLPCU8Z5vBPDSifneI45GY9:aZRj1QNU1MuELPCZrPm6e/YC
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral7behavioral8behavioral9
• • Target
    Ligydidae.mam
  • Size 955KB
  • SHA256 59472058deeb4c40447d44502936e0362f84c130249ad97e359adb960d9e0dd7
  • MD5 d3f6868c0818103e2ecf2a34be561aeb
  • SHA1 603300772c2e961c6b8924dc737bc1d6e3aad159
  • SHA512 e388c4886f34a2d962ff153f14c6d2abb2cabceb6e48ddcaadb0586bd890933d70bd84c70f2634f7a7f9a038e6244b76e0343d849baabe380ecdfbb6b1ced6d6
  • SSDEEP 768:zBX1IOuKrOPRy82KI9huCuYCrQFsOxix64y8nTnHxsqqJWtFfhu2r6FqRYHsMvMn:dYjy8nWNmIv18yF2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral10behavioral11behavioral12
• • Target
    Marxs.ano
  • Size 621KB
  • SHA256 ce0784c072efc078117a326dda548f2031aa2481b16af9c85e8c555e95dbe085
  • MD5 b30e2818d30caf2de7668fbb9586382f
  • SHA1 d2398dbeb49bd4bd41e82e9779f13fcf136594ef
  • SHA512 674ac7f99bce1cc0da759cdefd515090f9a329199194de755ee4cf4f104db60082aafaadb0810d1c2b0d38343e37eeda091fcc446a613347b93423b90fde6fed
  • SSDEEP 768:lUFYHDGM+Ozg2yd8FfwMs++juZsLvKi5rQiYz0TPnDEFd1mg9HZaZUPmqmmLIsz1:lzdfEj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral13behavioral14behavioral15
• • Target
    exothecium.txt
  • Size 524B
  • SHA256 f04a389563c38da5da4ea895509f8755f78893ede1e4de8511fca96d5d0eedbd
  • MD5 f1caf21e82b7fb835823862a5f1eb5de
  • SHA1 8b7a89de09160a24bfbe09da1643d20519f39394
  • SHA512 aae771bfa9a488141a46935fb424151cb14d884013b7da8e28cec9ec6a30099e687bb7cf2bb1ef6e50b1fa06128763516e97bc5939ec0a9d81ef447e435046f1
  • MD5 SHA1 SHA512

  Score

  3^/10
  behavioral16behavioral17behavioral18
• • Target
    laantagningen.sav
  • Size 1.0MB
  • SHA256 5081bd8604e276fda7597c7535e34c5b8f3a136a1b3d4de4289b0ea20989784a
  • MD5 a9fff331f6abb942fc5c35e1c29e4be9
  • SHA1 a2df0ce91e27d4d8f483db82c0d7749e2fab819a
  • SHA512 deb8f9dbc391ca31ccfd7d4ba52bb9aa69a0ad7c2f2132217af0ce6697616c6e76cf29b98686c416d90a90b817afcf8c34d6cb5b1a550e94b4195da86c71e782
  • SSDEEP 768:277XUFU0mP7ZunWraygWVwW7xZPwhrzIFAD/C3mzYhNoGc4MNTopVke62XIlZk8Y:cAd/t+0oBIaW5cSc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral19behavioral20behavioral21