Extracted

Extracted

• • Target
    PO #54321.exe
  • Size 350KB
  • SHA256 795fee999993e22fae8da87b93bb31177a8383a18b53e122cab3b42b6abaf5b8
  • MD5 dba38cd8669ea13aab4dec465f7c97ba
  • SHA1 42021a0c7ba87ab9f5dbf6e5458100123d05865a
  • SHA512 de47d7b222472de6d0589793210464e3d613052d6916f487ac69d59727b9cb2e92e66e9b8a46c17a56144e95ec58fae36ecad63a772910c5bcdb45f0b7e1f9ef
  • SSDEEP 6144:SgORaspjQel7km82cdrTxE0fhm9DuZkOqNcvutxRoz6R+8FKRDMzd:Sgyjz7kXFrT9f4DuZ3qautxmz6R+q4
  • TLSH
    T17574C0A1F29984D9EC46237159BBEC3325577E2CA875051F316B3729AEB33830467E0B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 b7823a15e7b1866ba3d77248f750b66505859d264cfc39d8c8c5e812f8ae4a81
  • MD5 a1da6788aeaf78ca4ae1dece8019e49d
  • SHA1 d770155e6e9aa69223be198c44a8da26a1756d89
  • SHA512 eada9c1528563ddfe3d4d8ed5dbc52b85a9190765535b68da90e6d623288bf0090adac5118e1ed6e3cb3e0abb9af025d3a2a73121413a4471a90fd04bc861e18
  • SSDEEP 192:uenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBUIwL:u8+Qlt70Fj/lQRY/9Vjj+L
  • TLSH
    T144428D1193B089F2F590583801A67F2A6FBEAC5C27E84963CFE341853D702DFA47A243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryadwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 48c290cf400a8e3a5e6cded2f4817d344c4d20745c8659cccbc09edad5866dc0
  • MD5 9cbefc918a4560f3e780bc927e0e4008
  • SHA1 4c23e9947f5d2338b4cfeb870cc9f9dcb7ee37e3
  • SHA512 7a11aeba9bfe309c9baaa9bd907218b238fd09a98c55c5d34949b8f5b4b6402e3efb7cb3279c211459cb6d27b689896c0a54ed92155d25f5828d18377a5b4bff
  • SSDEEP 96:o1svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YrJNqkz6:o1svWyNO81b8pCHFcM0PuAgkOybIFc
  • TLSH
    T1E512F992E6A450B3C5D7533A35AA2F2DCBBD5325B0926C00C7738E4D39355B66E38353
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6