Extracted

• • Target
    DHL-AIR-WAYBILL.bat
  • Size 1.6MB
  • SHA256 abcdce91fde094dd2eeafa37e7cf5c8c9a880739b53ed0b882770cd55ee9fc52
  • MD5 5614a332eacd0025f83cbf892d4be846
  • SHA1 b155ba956a29030dd10bce50b788ad774b21cfbf
  • SHA512 dfab530c3019c073c83d6accc472c9017931ffdece3e516796218559c93452c6aa7bb6ec98f5673bb16453fefc6b3333d9613875fca1cebee2d5d1611d3a78b7
  • SSDEEP 24576:JeqzkVnLsr2uqZUrfsrOObPuQ79tr9RAEabKyeE+17mop1RM4N4/hSBDy6S9H3yg:dz1Prsp/9jzyeE0Nl89H3jMG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryevasionagentteslacredential_accesskeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2