Extracted

• • Target

    74b63fc7533ba2dfd75253a2ac5044f9.bat

  • Size

    752KB

  • MD5

    74b63fc7533ba2dfd75253a2ac5044f9

  • SHA1

    20c6f4f4db0e850f1506e7d89be267f2fa1b21e2

  • SHA256

    fbcceeb087e972ef29b0e3561a022aa4e6897cd78de77049e130e47bafcde554

  • SHA512

    ff82f9a7138fce1aca1c59fd0fc7b050d59a5c507af33beb599bec543b7b3c8186a7e7ece3c8aa47ef5383d115b06231e80bffc398598764fd642a7228e23bb1

  • SSDEEP

    12288:nXJaAf3gv3zDtlZcqY18aAV0uyXVU62+eqvIwLT6Q11m14VELQrr+ZuHu/bf95Ro:5aO3gvjs8JV0uyXE1w/K6ELDuO/J5e

  Score

  10^/10

  discoveryexecutionagentteslaguloadercredential_accessdownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2