Extracted

• • Target
    PO 041-P14013-398.pdf.bat
  • Size 5KB
  • SHA256 40d48781568820a8ba1f57b7865a5d6b6aef2d5f91d09f52de4db1eaa54d36f9
  • MD5 193a04450871b8d8932d4f07c7c872fd
  • SHA1 45a478a93e666bb17e6fa73d4b25254678dcef63
  • SHA512 d31f48d4795349b2b68bba399428e332401299b1a9afd109493aab113e8859cc786762f2623009273c1a54ccfd5095ad45bf6e7fb39782904aca3450757e8e7f
  • SSDEEP 96:eRCTlzYTQcFvVNzS44VBzZ7xeCgEHQgNCj0tRkt6Yy2/mYFZAFy13is+:Ll8TtFvVNzS42BoEwmC4tGtqkm+ZAI1W
  • TLSH
    T1F3B173BE4BA8DBCD02EE164184EDDC9610B5BB2090416F5CBBF99A4CEC3B50D12F44E8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2