Extracted

• • Target
    MT103-0011.06272024.bat
  • Size 870KB
  • SHA256 a7d2ea641dbc8e50000e6b42c9cca200fa25d5e37ddd1857eb489795ab5564ee
  • MD5 95dc64015aa43a27412f7ff0979c5b87
  • SHA1 bde0ae97f4f98c0dd8a0833702ff073befbec268
  • SHA512 450a8ba7eb3c3178b5567b692d55518d393af5d971bb22ab13e1c9078c9ea389f1a9e28d391a8882ef8d1b99972ec27af64fa2c7aa8fa79c9c0d2423d0176d10
  • SSDEEP 12288:XcIjd3nQIQsk3na+QiLPTEYLwdLh5d2tqnXQJgcCp8vGiVIkk84n5QWrV:XcIjUna3iLtwb/2tWXMi2rq7nHB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2