Extracted

• • Target

    AWB GUÍA AÉREA 5526456806 OBSERVACIÓN MODELO DE ITEMS.exe

  • Size

    1.3MB

  • MD5

    70b62fe5c9f6a8bfccb0b2a4b8d45e84

  • SHA1

    129d8ca1944bcf608fa12a032d254e7dc08c2cc7

  • SHA256

    3c0c387ff08da55e2f2f8062bae3732ff7787a95aa8c6371482be5b9c719ef9e

  • SHA512

    dcd7ef997cc75035340e68706094a0c118f1beccdcc5862c21a96458726b89b6fdb3f9563734630796bdd164e5f93dc0e61ccb27df27235c376c4e54ecbe6170

  • SSDEEP

    24576:ctb20pkaCqT5TBWgNQ7aWQXC9PnTYBN9mSSsNcG6A:FVg5tQ7aWYBBBSA35

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    GUÍA AÉREA 5526456806 OBSERVACIÓN MODELO DE ITEMS.exe

  • Size

    1.3MB

  • MD5

    70b62fe5c9f6a8bfccb0b2a4b8d45e84

  • SHA1

    129d8ca1944bcf608fa12a032d254e7dc08c2cc7

  • SHA256

    3c0c387ff08da55e2f2f8062bae3732ff7787a95aa8c6371482be5b9c719ef9e

  • SHA512

    dcd7ef997cc75035340e68706094a0c118f1beccdcc5862c21a96458726b89b6fdb3f9563734630796bdd164e5f93dc0e61ccb27df27235c376c4e54ecbe6170

  • SSDEEP

    24576:ctb20pkaCqT5TBWgNQ7aWQXC9PnTYBN9mSSsNcG6A:FVg5tQ7aWYBBBSA35

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4

• • Target

    GUÍA AÉREA 5526456806.lzh

  • Size

    666KB

  • MD5

    10645dfbad205e839fe7e929b2d887de

  • SHA1

    47c5b65c641d6c914e64b404c6a98435efa71198

  • SHA256

    1ccd9f18aa34d71dcfb2e4d488de0952cf165080a63e20f3cc097158667e6bbd

  • SHA512

    0877fbe7a5141ea040d95ecc867e984b6f4ee0e4952184b9c9bcceb50fd0b1c5ef0c3176afe4bb253d16ec38ba97c415cec6e62c0f094ff74601cf457b163d91

  • SSDEEP

    12288:TRknDaWWW3v4MlcT5I+SO/wRGVhTeUko7hRv3y+y5zZrLuGlJp:TRknDaW3gNO+T4RGVhSUn7vv3fC9rLB3

  Score

  1^/10
  behavioral5behavioral6

• • Target

    GUÍA AÉREA 5526456806.exe

  • Size

    1.1MB

  • MD5

    9943450c5d5c2f2ede521f05c3b9632f

  • SHA1

    b245ea0fa36d1e100047dc7b40aba0d7a1e3aebf

  • SHA256

    8fe864adbc9a6ec504fa9629494b1dc4091472e655e455ea749a57febac23d6a

  • SHA512

    d86650d071b855f39f67b827733b14d368a753885a4e27c9c759b1f77144657c59185b4e032bafdd4b6c1fedc0cd7ddf9adbca8501e4fe96ac2289512022099a

  • SSDEEP

    24576:/Cdxte/80jYLT3U1jfsWaHW7DU6JYqauCtjIMQ:ew80cTsjkWaHW/hKs

  Score

  5^/10

  discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral7behavioral8