Extracted

• • Target
    ??????-POORD210865679-09XY-21-Order.com.exe
  • Size 506KB
  • SHA256 31eb29c56f113f47c0e4d29f346f685db8a00b9394efa9643caafa254f0618d7
  • MD5 cc1de5fc5a01a4157d61a28961ace142
  • SHA1 80d84c0ac436370e87a583267fcd44f5d55df0f1
  • SHA512 9b8efb3c717f2d33342a86d94da3d7cb203636ff7cb892c2b5b3bf0dfb27bda099dbaaae3b8a12089967bf885350f552087e127499d0145a3b54a9e76ab6b69d
  • SSDEEP 6144:VhRkHGPBfjVd4QMtGOipbEOKEvV3OGOizNm0OGtTd0K1eOxnrpAAdvHnICdmCFfC:PGu+Q+idEOZFO3iN710Va6uJAC5C
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8
  • MD5 55a26d7800446f1373056064c64c3ce8
  • SHA1 80256857e9a0a9c8897923b717f3435295a76002
  • SHA512 04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b
  • SSDEEP 192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 c1cc3aa4326e83a73a778dee0cf9afcc03a6bafb0a32cea791a27eb9c2288985
  • MD5 ee449b0adce56fbfa433b0239f3f81be
  • SHA1 ec1e4f9815ea592a3f19b1fe473329b8ddfa201c
  • SHA512 22fb25bc7628946213e6e970a865d3fbd50d12ce559c37d6848a82c28fa6be09fedffc3b87d5aea8dcfe8dfc4e0f129d9f02e32dae764b8e6a08332b42386686
  • SSDEEP 96:oCqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4iqndYHnxss:oCq+CP3uKrpyREs06Yx+dGn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral5behavioral6