Extracted

• • Target
    Zaplata.jpg.img
  • Size 1.2MB
  • SHA256 0343b65d72d6de7e249af0cdf3c5531982b1aac457a758bf2948bd56a2cd63e9
  • MD5 1f0357047217a540767f21466dd5ab66
  • SHA1 c30fb230004f53cfea793824676df56ddd8fb272
  • SHA512 750b20afcf522bf9cd2bbae961cb6722eb5f4e6e53f9a9672426cc0257eb29dc245b5bdea23f86a7fd7f0a8a5d758c0a7faefe2bea7115f163c477db38274390
  • SSDEEP 12288:kuFFZ6BKGu3ZAJ7ECGVEJIhlu4gvSD3tYE/B:F6BKGW+EV+/4bYE/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral1behavioral2
• • Target
    out.iso
  • Size 1.2MB
  • SHA256 0343b65d72d6de7e249af0cdf3c5531982b1aac457a758bf2948bd56a2cd63e9
  • MD5 1f0357047217a540767f21466dd5ab66
  • SHA1 c30fb230004f53cfea793824676df56ddd8fb272
  • SHA512 750b20afcf522bf9cd2bbae961cb6722eb5f4e6e53f9a9672426cc0257eb29dc245b5bdea23f86a7fd7f0a8a5d758c0a7faefe2bea7115f163c477db38274390
  • SSDEEP 12288:kuFFZ6BKGu3ZAJ7ECGVEJIhlu4gvSD3tYE/B:F6BKGW+EV+/4bYE/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral3behavioral4
• • Target
    Zaplata,jpg.exe
  • Size 561KB
  • SHA256 c5425d62c01551e1c243ed453bf14d0b51ad7e890d59ef469c5b9418bb6361a0
  • MD5 6f9e931132ed53e111a1d022395a5b7d
  • SHA1 aba94805466d7a2ae0f5be485d3f9930430e1f4b
  • SHA512 45c40fd55594f99bd120f5f150f9dca8e59147f8407d5270464d122a7aa7385d42dcfde721fa931ad7b9cc32ce076e3e037d14bfda7e8149375dfa8b1d1f0c0b
  • SSDEEP 12288:OuFFZ6BKGu3ZAJ7ECGVEJIhlu4gvSD3tYE/B:76BKGW+EV+/4bYE/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral5behavioral6