Extracted

• • Target
    8c2601919d790b433ff900f7fc77c4b58d7cbf420407d0fcca7014d70cc145b4.eml
  • Size 1.7MB
  • SHA256 8c2601919d790b433ff900f7fc77c4b58d7cbf420407d0fcca7014d70cc145b4
  • MD5 40ae85e79ce9003ce69ed903b92f2b09
  • SHA1 92096fdf7c72cca06f0875da1465a19355fe5c38
  • SHA512 eb4158397c1655f0f25f224ac3d71513028b2f96a6ecf2d0638fe5aebbcef7c1d17b7430b38f397c13f62f007e29360aa2e42742280cc5e15fb832b593480d7c
  • SSDEEP 24576:LG62OoXImGtEOCJsouUy8l84ZHuY5mX7q2SAyYkWFJc3XMQDPvFKJ67jLsqIG7DA:iBXy39oH3XHuY59xYW38lJqI8yj
  • TLSH
    T1C5852354D74B01CB4C33D4FCF227F326B499068DDA8647B6627CD26938DD0B836B6A89
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10

  adwarespyware
  behavioral1behavioral2
• • Target
    JUL SOA 15,340.61 usd - 25008S 06WLUS1NC CMAU3178562.rar
  • Size 1.2MB
  • SHA256 38560fffb79393b5278ca1cd1eac1a8c4ea695f4f04a0071cc43f4398a85e674
  • MD5 4ac3d9c1f0d7c25a1bec43c8b8d6bcd0
  • SHA1 b2504c601fcd94b6f4a6235a7644bc70fc289a54
  • SHA512 d76a70f06f3f4badd94bf5ac64d14a5ca29ec710afa78ca137b574f4a566afba3f4b3c729963cfdb4f9e65cbed294f5fa7ba0491adef396cd8203746d3c15d06
  • SSDEEP 24576:u1QcmeRwPC/AlrDajvJsyeizJfjmaCrAqNbqf60jK8Xs6KfIgau6y:8QcmeRKMS6zJci9grPNg3Kf/P6y
  • TLSH
    T1024533F9D18DD67C17F50A7B4F84D13D3711A606AA0DA3CB5AE83DFBC60A229D94B048
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral3behavioral4
• • Target
    JUL SOA 15,340.61 usd - 25008S 06WLUS1NC CMAU3178562.JS
  • Size 3.2MB
  • SHA256 bf6eb18ad8b1f477668a2e5a4a19774d194e6dab26e46197c9884a3d5e1020a0
  • MD5 639d228cb466e2e75662ff24536129fe
  • SHA1 1b6f99a868df636cdfcaf5fd826eddd79e3209ec
  • SHA512 3363eb8b5934478fb89edff53c1cbb5d7fad1b418ae298a1644c6852ece7a1d1314065d7e08d45b635f92012a5f78eb1dd75eaa97ae52ce27325e378f721c4b7
  • SSDEEP 98304:3UNZG+6PgrQ2ZkXk2QcxB0qSLOLrjkGu/bu8alW6gFkw/QY65/CJh4vsKWlEI:3UNZX6grpuBQcxB0qSLejcFalW6gtkC7
  • TLSH
    T12BE58212A3046976BA3D4B2CC2776D28994962D713D4EF1EB5BC660C7BB2A27134C4F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral5behavioral6