Extracted

• • Target

    GHF0987654678023.bat

  • Size

    551KB

  • MD5

    8039843db211432bcc15e74c1e8c6da6

  • SHA1

    576def6d2d028b443e4eeacbad28ae8b153b5147

  • SHA256

    d9f4242482c295b7d65dd05b6f19a8d97e2c531cc2f84708b85cd176ba830615

  • SHA512

    b80ff9427dfb0063a7cd6bddc6324cd71bd0b6aa328be35f419e438f3c79e2fcd677130743687c9a4f3762787de080a13360cba78d4410e46e1e43522c230d67

  • SSDEEP

    12288:FYV6MorX7qzuC3QHO9FQVHPF51jgc3cSzl3VY9Pj:6BXu9HGaVH3tx3VY9Pj

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2