Extracted

• • Target

    INVOICE09876545J.bat

  • Size

    633KB

  • MD5

    38febc8fe240353eab810eeedc379961

  • SHA1

    4145de7c3f531f10c786d09302923f0572244d53

  • SHA256

    eb59c6e8a42daf2f27f8112f109e563128e0d2b3a4cd9a074832e68e75cb9870

  • SHA512

    a276a728bf50085a0aa2902ef4dbc97a88d6b4428a2ee1a75474382b451ebe8bec3bc126845d470540df06f72004c9ec3a6481f3ecfaa6446719910f3b9490b5

  • SSDEEP

    12288:tz7hU5I5yuNHIgzSFKxWltRohBfSTso93UCv1hNhcFVxO4ePQnAf2Oy15:tf+iN57Gtene3lMFYPQnAf2OyH

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2