Extracted

• • Target

    cotización.PDF_98776456879808756846576879806765687976457687986764.bat

  • Size

    88.0MB

  • MD5

    e4a8ce0f507c8ba1023007a3fcfdef7e

  • SHA1

    ae93d87dc7532f2c330e2ab7d39a39f131dd959b

  • SHA256

    001b21318e75c49c1b0e415008530611da89163328b29d65ade1f7edde25328d

  • SHA512

    97370fc754fb67fa95042e706894a4e36fe7f5337aff32490506e7f7738050c6dc2bec68561a1228312bf99985aeb330701b440a57e169416c1a690cd61220fa

  • SSDEEP

    12288:v6Wq4aaE6KwyF5L0Y2D1PqLuKjL6vV34jxMQzpWlXeXpddOgLWHlqd48EJGpZpGe:tthEVaPqLnLoVqxsuX9uqd4nG/pG3

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2