Extracted

• • Target
    PO250000Corbela.rar
  • Size 200KB
  • SHA256 49960bb75757a3c51293eb50ac3bae71303fe3626fe3aca1b2d0d0a35c47093c
  • MD5 7e4c7c1ee0e46f7b68ae52c684a21abd
  • SHA1 7dcfdaa19540c74e06a174912d1c32e5867ff4e6
  • SHA512 7eda623165bc3b588b56c11278edb65911b2b1b749e4daa23c0d50577dc9de5c5e8066639cbbd314195c6fb83307ab55ac1d66f4b9ee7fdab89c7ea1d38b3500
  • SSDEEP 6144:X9r7aszS28uxh7zlRcrqRNZBdETafpy5q+rrUVUH3x:X9ZzSg7H45qoUwh
  • TLSH
    T14D1423762ACD76BD4B4ED381F5606CC389E07738185DB24D963C45B781CAE7228AF09D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1