Extracted

• • Target
    _2009c2095160ce4c016855f7af23529a143e7533a5624b60f4dbc277ae9a7bbf.exe
  • Size 229KB
  • SHA256 2009c2095160ce4c016855f7af23529a143e7533a5624b60f4dbc277ae9a7bbf
  • MD5 bd9d6c8361b4d9ab9cf22f177273ca03
  • SHA1 a33adebc327a5548fda826b1c0cdf55899af31e4
  • SHA512 f758e7e85657965ca12dc7a93043f91d9b8b0b9b189072d0cfa135526379e7e9257e82bcd4d11c40183e6ef0aaa2acbdf1cdf06adcc8811f2062d99e197241b3
  • SSDEEP 6144:8fY+onP0DOYpTXPtd/d3u08BuOwiGoqrwZi:8fYgOYpTXP/E08BMigii
  • TLSH
    T1AB3402417FC0E006DA9262396CB93F7693B52E7AD6D38B9F4390A7483ED2782015F653
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
  • MD5 192639861e3dc2dc5c08bb8f8c7260d5
  • SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
  • SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
  • SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
  • TLSH
    T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryadwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4