Extracted

• • Target
    SVR26-616 - PDA - MARLIN DUA - TLP.JS
  • Size 3.2MB
  • SHA256 50ac7a4b85c3a8951b74379c72cf11a4ff02507a36ca387b27ce712573300fa1
  • MD5 5b9a866d950a7d5262d34b89efc24b84
  • SHA1 e4fb6be033fc570b5e8ddf62d8699b5ec513982d
  • SHA512 1fc2312ecf38a633d76ff765c197881b0245b082cc28e8217526562275200f3bf2694c79de3e76db49297f603d01f82f0bca9b75b2cccba4ad7ad41ab498cc55
  • SSDEEP 98304:d9v6rq7sD4E2AXydUGcav18XJ9cpYSmAEunI1w0uAOHYA80WB9V/vpSu:d9v6q7s0E2AiLV90J9cpYnAECI1DuAOy
  • TLSH
    T196F50A4493979932B734EF9C813E9E20A44B564310C5CF26317CCA1EBB7CD2BAB196D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2