Extracted

Extracted

• • Target

    Order_Request SO-124465.exe

  • Size

    924KB

  • MD5

    23af09149a763422a984f75d1aee99f7

  • SHA1

    a744ec1977556c64257eade7e9f3bc8c903d14f9

  • SHA256

    3c0b9b0b239b7a68824a36d9d9e724af717ae05fca697e0563cf93e24a22e335

  • SHA512

    a8a6c94cbba7244de717508905af6791ffa8bd2a0a1e06776def50f76195deae3c9ff0a0e4922d76df5315654ee54e1ad1bc58e37871a255bce2f714f37dff00

  • SSDEEP

    24576:GuA8h591jcS39X+6RJNBIQll+hQT2jiux51:8K31P9X3RFIQlluQsx/

  Score

  10^/10

  discoveryexecutionagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Loads dropped DLL

  • Blocklisted process makes network request

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/nsExec.dll

  • Size

    6KB

  • MD5

    51e63a9c5d6d230ef1c421b2eccd45dc

  • SHA1

    c499cdad5c613d71ed3f7e93360f1bbc5748c45d

  • SHA256

    cd8496a3802378391ec425dec424a14f5d30e242f192ec4eb022d767f9a2480f

  • SHA512

    c23d713c3c834b3397c2a199490aed28f28d21f5781205c24df5e1e32365985c8a55be58f06979df09222740ffa51f4da764ebc3d912cd0c9d56ab6a33cab522

  • SSDEEP

    96:W7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgN738:Iygp3FcHi0xhYMR8dMqJVgN

  Score

  3^/10

  discovery
  behavioral3behavioral4