Extracted

Extracted

• • Target

    Documenti di spedizione.gz

  • Size

    531KB

  • MD5

    7314ec0fcc64f0c516e503599587604d

  • SHA1

    515ef69cd9d0b15c6eb057893d9446c320dadaca

  • SHA256

    8a81c3cc487383e9f4373e5a89a0ea1a8f376dab654d5f476590a3991a832be1

  • SHA512

    637fcf2af10f1eadf0c50c59dc1d7b4b26eb44311acf0f343df2dc3888ff6f24d02fd4ab55b13151f31f7f81f9e55405ad5f4bd4f2ef634fa6c97bd2617a25dd

  • SSDEEP

    12288:qJfA80L8oMzeTbJsZW4vQgw2bHT3bL35hbWraBdDdLb8G:oIXIoGalkYg73bL3ZPJ38G

  Score

  7^/10

  discoveryexecution

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2

• • Target

    Documenti di spedizione.exe

  • Size

    617KB

  • MD5

    79cb40033e328f61fe68bd76dd67a7b3

  • SHA1

    a68854ec2481fc2f874e2180dabb155e65c6fbd4

  • SHA256

    255ddfdf1409d89110925cfa93ba323d1a68b6c0916764169eeea521867816a6

  • SHA512

    7ef13f9f7e75c865a7c8140b9c615687e04cc1e46076de75a963952dff2d000576481854dce0e98cde8db9ee9c12f43cd8def9634fc7b00b09a0b95b6ca6e3cb

  • SSDEEP

    12288:MDG0VKZA6BbbHyqrSXA8xvJMUzPvRQIBD7f/KYC+c8cIti62JB8PoZSBm:QKeybHyYSh1CefD7nxFTcIM62H87Bm

  Score

  10^/10

  discoveryexecutionagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral3behavioral4