Extracted

• • Target
    Prova di pagamento.rar
  • Size 1.1MB
  • SHA256 bae6026184a823d31ceec6572f4ff05a322619f81da2905c707007e5586a2220
  • MD5 6ad90ac6641a87d32d35d2155c0cf731
  • SHA1 78c0f3442a6e5fb49438a7ebf7fb562f2905c65e
  • SHA512 63d333a4ba815c9f35de371c9805664cfc16d77ff5ed69439d42e58c7da794786f3655dfb8c3d8160eeb42dc9438cb11a43eebf7ed4bbfd1187f62c1646b81ab
  • SSDEEP 24576:FVWdHfG3db3kfVUyWOwJMSYsFwqiWjhon6vqocD62hlmcE/:FVW8Nb+UyLw/7CaoQcm2hlmcE/
  • TLSH
    T1C14533D2F52404C5E80E52E21F2BAD246A1BFCD95B23F1A5FA2D1518B3CC1E65578E33
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    Zahlungsnachweis.JS
  • Size 3.2MB
  • SHA256 a52d3a7d53a18ad4a2330e0116fc6f6de453b6d210d6aaeae809a4dc1f73add1
  • MD5 236f505f9c2a9a3f779a87da93ddc0b4
  • SHA1 cc69490ec1ccbe87a96c7a17912f3653b2fe1c88
  • SHA512 744bb25d1a72995e996a0aefb4b53485f64feec1a34665ec405cefad61c698116c96ddcf2c3049cc772bd43c61f5c256ab9b91d16349c480be39098c78fc2800
  • SSDEEP 98304:gBD1mGuJvQdq57MhAdRhWgxgjhMm9mtIJH1mO+PbcOuu9I:gBD1jXUeFgQOuui
  • TLSH
    T17DF55C509428A8B4BD3EC33CE0377FA0465E350B2119EE2E36795658A6D3F472A9D4F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral3behavioral4