Extracted

• • Target

    1016403202.cmd

  • Size

    4.5MB

  • MD5

    e5c9920ae6eea67428c0acda90f6a5a9

  • SHA1

    d9929aeff92b1e019f02616c06a12ff0ecbcc184

  • SHA256

    d879e51fe3bcd5d2d0c147eb82453a1e513ae9daba471017951897c81777593a

  • SHA512

    a28359623458077f6d43cf41d8bbf826b9f76ed406d15daf1136ae389dd05de2d78ab9a7844200a3e8669592a1843f0518b6cc433b28a817b62ab4e6010a7f43

  • SSDEEP

    49152:JvFG+6Aq/2kz4//k2sSh6KkJctutTKULH1mohKhp7c2nX4dj9ZnbHX0g5x5LOUqb:P

  Score

  10^/10

  agentteslamodiloaderdiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Modiloader family

    modiloader

  • ModiLoader Second Stage

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1