Extracted

Extracted

• • Target
    Ordine d'acquisto.bat
  • Size 1.0MB
  • SHA256 fb9c0e098115c2f0332e0603babbc9b1eaad5537a56c525495d754ce80d737a3
  • MD5 013376c01efe2b412c2b7d817b6d2b8e
  • SHA1 4def87de32cdcb1c14e350745fa59de12f9c108f
  • SHA512 3ee5cd10c68d21187f5bee56038f9b0213c4418fe633993dde707ba92e459a69e6e0e9c96d0cff8f7fa276548fb8f6810248f2c48c2b8b34cea1c89537fc95a6
  • SSDEEP 24576:KWFgDoYQeZP1K6YuGAQrYjG7GoTTCokJx:doopk3BjGiOTCocx
  • TLSH
    T1F135025022EDDE06D1E34FF01970E37007B4AE896521D20A9EEABCDF787AB8568553D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2