Extracted

• • Target

    BANK RECEIPT.exe

  • Size

    280KB

  • MD5

    6317a0b98ebd6f0ba716fc1b73b4bf31

  • SHA1

    6f593ad2588b2ca2e561f0b47c9654df9fd95932

  • SHA256

    a2e99d0aabd8f0ad83b885eccf313563526a58b2da435bf34dad29294c712efe

  • SHA512

    e29265b8cc385be1c86751dd04dd2a70d727e8e298cd0d0ca250c2c6515c8d1c189511c564de11cf9c3c85d3efed1e23f7ad4b91bcca156b6b7c4341195f449a

  • SSDEEP

    6144:7PXvBKWuizHoEVrwSNvxsjZ+3Dd4ECaGbz3cA+A0MQ01:tKWNVrHNv2lM3yZ+Wf

  Score

  10^/10

  formbookdxediscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/2g6ght2plrugud.dll

  • Size

    5KB

  • MD5

    64ade443342d3aa3790c2846abf93959

  • SHA1

    d6668f6881d40dc3dc3d1f627f2721e1d333e698

  • SHA256

    ea1deb95fa6614524006ee3260957aef27ebd563f609dde680cace5f2ea09e45

  • SHA512

    2fdce6c768ded710d6d011be5317b184a09e10058145bdff545e83df63f5e0f46db4f679161174397b37d0fb2f43abe7275405845742e4a73bc6ef995edf4845

  • SSDEEP

    48:aiVuJ3n1ASkT3rNDZbitP8XgRYB0K/PbKq1nh/SS72+DtMYquSzieLURuqS:/43n1ASkfNDZ+tBYB0A/2otsJzax

  Score

  10^/10

  formbookdxediscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4

• • Target

    PO.exe

  • Size

    228KB

  • MD5

    2593eef7b38e160b9697f2479fa8843f

  • SHA1

    25d4d88f321321fb5b2b316fd5dbcd5bb144daa1

  • SHA256

    b35de004189f271fe754dd614e5fbbc299425f5aca9ebf1f935bf26696964853

  • SHA512

    c5beb57aae9c18ca5d7d73954216abc6a07871666d08a654d7b5d8e1d25b0defe9ca66eee77325bed03870a39757c85df13f868472447369bd2903ba05336a21

  • SSDEEP

    6144:lPXIegRJRwlTL8+GiAUUv5hotXkpqfc9F40:aegRJ+q+b3kpqoj

  Score

  10^/10

  formbookdxediscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral5behavioral6

• • Target

    $PLUGINSDIR/k5ig8v1xqqd111h.dll

  • Size

    5KB

  • MD5

    fe9e8afe6e228256eaf3065c403d87bb

  • SHA1

    1d46976328242b9e4f37d994bc1f169ee1f4c112

  • SHA256

    e2b161127954eb1373158a95ef083d1b00198fef933e9ad5a1496d82d9006b8b

  • SHA512

    573399e2885f89f05e27de783ef286c79dab04ca4e942f62ccbbb40d61fc7ab80baa97b13948b719dcae785d5daa19e4aa23adb4922e9737e0ecbfc2a09ba4a5

  • SSDEEP

    48:ai7zn1ASkT3zNDZbitP8XGeHJl8gIoq1nh/SSb2+DtMYquSzieL2RuqS:/fn1ASk3NDZ+tSJKgif2otsJzwx

  Score

  10^/10

  formbookdxediscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Suspicious use of SetThreadContext

  behavioral7behavioral8

• • Target

    STATEMENT OF ACCOUNT.exe

  • Size

    387KB

  • MD5

    5932bd9d5a231f2dce386609a1c80ba9

  • SHA1

    94b257813d301d75895d0fee69a8acc224cca82e

  • SHA256

    14e48e373fee4fafef99517fba97e5ea5727f764a0b92509b307f9387679dd64

  • SHA512

    c10ca6caa068086aef9e36aab1ec8ae9f83367a30fa213d54fcfd5c77f0115e1b4017ddb77cf28bae3761d75ee0118241eb413613cecf4431820d526a7ba967c

  • SSDEEP

    6144:7PXz3+5YKsw0UK0qAY+QUIgtTnmBuoPEhahHyHAmyiQoijPkLG:Pk0XfUZtTquoPIahiAmHdm

  Score

  10^/10

  discoverypersistenceagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral10behavioral9

• • Target

    $PLUGINSDIR/wfonpw4.dll

  • Size

    5KB

  • MD5

    2352a10c7c964ab3ab072f17a78cb77f

  • SHA1

    a41c5d247420909bb3a3565dd552990258904f02

  • SHA256

    271f00c08e8dbf27f0b36e27df2aa07be3e4492940118ae3e43758a812d7e370

  • SHA512

    14634bebdd077a674b02bb9548588868ca56145e497fea67be211bd2887bec65b02c75f7edafdbff0d976ff9a424f8acc1ba0ab4244a1b86ebeb640ceb8c41d4

  • SSDEEP

    48:aiGzDn1ASkT3jNDZbitP8Xr0EVg56F22/vtq1nh/SS72+DtMYquSzieLURuqS:/8n1ASknNDZ+tw0Eem2Rf2otsJzKx

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojancollectioncredential_access

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral11behavioral12