Extracted

• • Target

    Documentidispedizione0002838844.exe

  • Size

    695KB

  • MD5

    2505793cd3edee5e7ceab9359a8a74ba

  • SHA1

    30437e6082392072f27fd3609e6aac5d161c45a8

  • SHA256

    8cce7f3f93f7d317da18beb13332f1ad601c4552022d07d7e28d1d836eedba81

  • SHA512

    58f4dd9082ed1b7721030f1f7ac74bdb7878153081839d13ebf0027ea9d47cfb198d9cad97645b915a981442716979b7ef48e751e13f69f0a7bcf7e0aab2a2ba

  • SSDEEP

    6144:JpkXchsEnW7+8WIEZb8Qj+iHK5sDlK+f+gsw8XuMEbHdLP7LoMg//YgNfegoWK2E:YvWIKbnKiHEsM60Z/Y8emeFFwP0nRUq

  Score

  10^/10

  agentteslacredential_accessdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2