Extracted

Extracted

• • Target
    PO-5326001290.bat
  • Size 957KB
  • SHA256 ef1a9cf8038f135b9f15385210228bf93c828e6ccc6d611d8d2f6a1b32581bbf
  • MD5 7f4865d6d40f379bebc25b4d19752aa3
  • SHA1 9a5a4a880320ef38323c467dff52447b719778e3
  • SHA512 82feba5e51f0a496ef748b8d7770773ddcb9044cb77dd3dfec240fd9f1454ccaca66cce4b73cf0ef9b84ca016187960f2ad7801d9ded92a66ae65d41c797bed7
  • SSDEEP 24576:uj/Og3lGOVhb+bKZ0UuoilfRyOaixuyyXsZbZFJ+aBWc:kP1GcHZ0HZJyObM8TFJl
  • TLSH
    T10125236EEB92E616D3CA47B01930D1B217BC5E9CC821D3834BDECCEBB85972439985D1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2