Extracted

• • Target
    c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3.exe
  • Size 846KB
  • SHA256 c0b99a4d83d20539cbcb64a75cf4195277d63ef20113a3d3d5a1affe9db263e3
  • MD5 0f74daa5854510d25d42b69aafeff0a5
  • SHA1 76426a8723ff019f213380ddfd0240ac26868218
  • SHA512 e50f98cace7f3852987eccbdc14d667cfb4a783f051e64d215793a6087a5dcce4e74f93b171616fc49728880349c90f6ebd02fb7501e2b1da4853163644f558f
  • SSDEEP 12288:GENN+T5xYrllrU7QY6fz7hU5I5yuNHIgzSFKxWltRohBfSTso93UJeN2CMImQjr8:K5xolYQY6ff+iN57Gtene3sCMIR20x+f
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasiondiscoveryagentteslamofksyskeyloggerpersistencespywarestealertrojanupxworm

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Detects Mofksys worm

  • Modifies WinLogon for persistence

    persistence

  • Modifies visibility of hidden/system files in Explorer

    defense_evasion

  • Mofksys

    Mofksys is a worm written in VisualBasic.

    wormmofksys

  • Mofksys family

    mofksys

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2