Extracted

• • Target
    doc002209025.exe
  • Size 805KB
  • SHA256 88147aad7aa96d552ff975e54a28a013be2a82510226daf9e5bba144912e8ac3
  • MD5 f419a6881410fba775cffeda26e4017b
  • SHA1 532c6eb2fcac8f5f424ae24ca854ccd999f87fe2
  • SHA512 154923ecf7187ff1280486f8922410e330d4ba38225a378d20e6f5be7e7f5c39a54c39446475145e0d283f45852a8378376e9240373e38255401015286fecc1f
  • SSDEEP 24576:vu9v6qLY9IEpgXRC3CXe+zmFdyuQsqTom7p0DvM:Kv6qLAVgXQaec7uQ+m764
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
  • MD5 81e268e27dbbcadbf116b5a9402195ab
  • SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
  • SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
  • SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 7853be9190489ba84dae8232e9a967cec02d941732cb4137bc9ae6a392e89fb8
  • MD5 3fbd78c889fa40a2e5567b980c57b7db
  • SHA1 303564bfa6fd5ab7a65d35ae1cd14a05643b6b5d
  • SHA512 95ccd599cdacb1128aa35694aa5428f12f50a20d95bb500e9b180b3ab322b1870ae301f77f7ca0e8674c78742a1eb5c82ba3cee05c67d3d961a695563c8c1514
  • SSDEEP 96:oX7lf7AR1VhrfzBik0cxM2DjDf3GEkniJnifvcx418qndYv0PLE:oXl7wrLBn0REc0JxedO0PLE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral5behavioral6
• • Target
    Khoums/Riant.Bat
  • Size 43KB
  • SHA256 1c90924c67272b9dffe75de4483983c12dde5d70b25d3c3a7b935209fb84fa42
  • MD5 84576452c833d1823934f6ccd1f714c2
  • SHA1 87eafd9fb78d18c1dbe5590f9216bbc0e287a076
  • SHA512 688d5e151e54c4b9bf70c369f3b2fb0f0c79866cb9ce0ee27e60ae74593a73ac8f4f5fb1272e569c9f3389fc0481ff2ef5af601c03f4ea15c991ab73a192b311
  • SSDEEP 768:UdH6U3ZmgBykwcEko7wRClttTfz9Q8py0z9m/rkf0hQhsih:mCgBMDDVrm6y0zErxQh5h
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral7behavioral8