Extracted

• • Target

    z11FACTURA0987654567800.exe

  • Size

    850KB

  • MD5

    4c086ea2cf962b2584e7cc978092f414

  • SHA1

    684a0a66447920947ce272d1db6479bac184d34b

  • SHA256

    ca690123d14bd3632ab53a076f8bfb7bd2176248af6b735af9719aca77a024b5

  • SHA512

    ea1aa1eb3d50c4f91d55538665cc2f32d470d6aae4b8decb14c508a67b7c8a7a8c7e02eecc7bd9553281cac21933b463bebc14046c1a48b8a9f269d27a5a13de

  • SSDEEP

    24576:tthEVaPqLaxPrH9DZJ7jPiOrxScRujiCEj5uuv:VEVUcuZZJ7xE6v

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2