Extracted

• • Target
    AWB GUÍA AÉREA 5526456806 OBSERVACIÓN MODELO DE ITEMS.exe
  • Size 1.3MB
  • SHA256 3c0c387ff08da55e2f2f8062bae3732ff7787a95aa8c6371482be5b9c719ef9e
  • MD5 70b62fe5c9f6a8bfccb0b2a4b8d45e84
  • SHA1 129d8ca1944bcf608fa12a032d254e7dc08c2cc7
  • SHA512 dcd7ef997cc75035340e68706094a0c118f1beccdcc5862c21a96458726b89b6fdb3f9563734630796bdd164e5f93dc0e61ccb27df27235c376c4e54ecbe6170
  • SSDEEP 24576:ctb20pkaCqT5TBWgNQ7aWQXC9PnTYBN9mSSsNcG6A:FVg5tQ7aWYBBBSA35
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    GUÍA AÉREA 5526456806 OBSERVACIÓN MODELO DE ITEMS.exe
  • Size 1.3MB
  • SHA256 3c0c387ff08da55e2f2f8062bae3732ff7787a95aa8c6371482be5b9c719ef9e
  • MD5 70b62fe5c9f6a8bfccb0b2a4b8d45e84
  • SHA1 129d8ca1944bcf608fa12a032d254e7dc08c2cc7
  • SHA512 dcd7ef997cc75035340e68706094a0c118f1beccdcc5862c21a96458726b89b6fdb3f9563734630796bdd164e5f93dc0e61ccb27df27235c376c4e54ecbe6170
  • SSDEEP 24576:ctb20pkaCqT5TBWgNQ7aWQXC9PnTYBN9mSSsNcG6A:FVg5tQ7aWYBBBSA35
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4
• • Target
    GUÍA AÉREA 5526456806.lzh
  • Size 666KB
  • SHA256 1ccd9f18aa34d71dcfb2e4d488de0952cf165080a63e20f3cc097158667e6bbd
  • MD5 10645dfbad205e839fe7e929b2d887de
  • SHA1 47c5b65c641d6c914e64b404c6a98435efa71198
  • SHA512 0877fbe7a5141ea040d95ecc867e984b6f4ee0e4952184b9c9bcceb50fd0b1c5ef0c3176afe4bb253d16ec38ba97c415cec6e62c0f094ff74601cf457b163d91
  • SSDEEP 12288:TRknDaWWW3v4MlcT5I+SO/wRGVhTeUko7hRv3y+y5zZrLuGlJp:TRknDaW3gNO+T4RGVhSUn7vv3fC9rLB3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5behavioral6
• • Target
    GUÍA AÉREA 5526456806.exe
  • Size 1.1MB
  • SHA256 8fe864adbc9a6ec504fa9629494b1dc4091472e655e455ea749a57febac23d6a
  • MD5 9943450c5d5c2f2ede521f05c3b9632f
  • SHA1 b245ea0fa36d1e100047dc7b40aba0d7a1e3aebf
  • SHA512 d86650d071b855f39f67b827733b14d368a753885a4e27c9c759b1f77144657c59185b4e032bafdd4b6c1fedc0cd7ddf9adbca8501e4fe96ac2289512022099a
  • SSDEEP 24576:/Cdxte/80jYLT3U1jfsWaHW7DU6JYqauCtjIMQ:ew80cTsjkWaHW/hKs
  • MD5 SHA1 SHA512 SSDEEP

  Score

  5^/10

  discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral7behavioral8