Extracted

Extracted

• • Target
    Nowe zamówienie PO-2087441006.hta
  • Size 36KB
  • SHA256 12a0143bf4da5fdd8277f8f51dc6c5414b3cca94e58a00fef70ae07abe5cca8e
  • MD5 e9b9c32602aaecc89225cbebbe78b340
  • SHA1 695b971b4e65a14fa55ca6f0dab87015ab3287a7
  • SHA512 34c4be1b7c7e18125f6db46cdfa23bae7c5697517b896f24ddfe976a1021cdad356148ca0e4d9d8e523e7e204131ccdfaf57291c9689ba34659e315555503d0a
  • SSDEEP 768:FJIC6u18cPKRF+E754dbnM/v4XYujBlFQcrAI:FJIC6u18cPKRF+E754dbnM/v4XYujBlN
  • TLSH
    T1A9F268364D39BA340851505BE9448CD5A9BCC90DBB7342AFFACA8137AB294DC04EED73
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2