Extracted

• • Target
    cdde99520664ac313d43964620019c61.zip
  • Size 555KB
  • SHA256 538ce99b1892f26c255e856c100143a6f0243e0ac1d9752665e10b402ae7bd45
  • MD5 19540df7377b7403a5599f8888054d35
  • SHA1 64e62397a83c4626ba47fa0751a1777830760aa1
  • SHA512 85f94fe5088e8be788f2dbde60f6f295a675ce81963be5bed0a90a71925f185361b9f4bfad695595aa00fd6809fbdc89bc8919dc8628f883648a2cb1cdf61415
  • SSDEEP 12288:G0K/m8QkOc2iAfBQwQ8xejg+jxkTRUmTg445FQMoSxGT/XcR:GBMhfBQwnZjTRUrFhoSg/K
  • TLSH
    T1F3C43302550A1DA47BBDFBC30B890D583376E897CBB6959DEF08786D0BE04465D33EA1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Purchase-Order_NO.231101.bin
  • Size 616KB
  • SHA256 40618ab352c23e61bb192f2aedd9360fed2df2a25d42491d0ab56eda5c2db558
  • MD5 cdde99520664ac313d43964620019c61
  • SHA1 8bac76a32bccaef31aa2bbdc59910a2b844040eb
  • SHA512 27ac3a7153355fb9e9602bd2f16fc8d4ad8cc0d8585da76a6f2c86d7eb6bd202c9dc04a0b1174e5860a679edf0ab09d6306590f125cbe4761f45598e231ef11d
  • SSDEEP 12288:tf49Cf410BWcfBSkQvQ3btOUMRZonhFsc0Z7Y2PWGPtW2:echFckQIYPRSnfAVTW
  • TLSH
    T1C2D40136166CAB54F03EA7BC2015540007F6E406FBE6E356FCE550EED9C6E468BB2B21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncredential_accessdiscoveryagentteslakeyloggerpersistencespywarestealertrojanadware

  • AgentTesla payload

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral3behavioral4