Extracted

• • Target
    PS-PO0726-8406.exe
  • Size 372KB
  • SHA256 a29fcd93d595590a046c3cf8272fc5cf332ece6964963160461605a9f9bf35a0
  • MD5 8c5259ac0a6e26f997b68c6da00a2906
  • SHA1 b66082973cb689030fe6796a3b8929869cf2d9c2
  • SHA512 c0925380e294ccd3822afd641b2162b0efa470d94376d3e86a917dcfe295777205004e269bcde78b62f3078da4d6f54fc630e7bb6a3c0340a1854376c8c21be3
  • SSDEEP 6144:aLsBN8xoInob4d/Opc8UgqEPDpgXZto4tlaazpBB8QdMmgw:VBSjApigqIVgXXZaazRbh
  • TLSH
    T15D84BE5D71827592CFDA61F60A2143F9932BEDFC201A433E6A613F57F4E628021E2B47
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
  • MD5 17ed1c86bd67e78ade4712be48a7d2bd
  • SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
  • SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
  • SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
  • TLSH
    T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 c13104552b8b553159f50f6e2ca45114493397a6fa4bf2cbb960c4a2bbd349ab
  • MD5 42b064366f780c1f298fa3cb3aeae260
  • SHA1 5b0349db73c43f35227b252b9aa6555f5ede9015
  • SHA512 50d8f4f7a3ff45d5854741e7c4153fa13ee1093bafbe9c2adc60712ed2fb505c9688dd420d75aaea1b696da46b6beccc232e41388bc2a16b1f9eea1832df1cd7
  • SSDEEP 192:o68cSzvTyl4tgi8pPjQM0PuAg0YNyoIFtSP:LBSzm+t18pZ0WAg0RoIFg
  • TLSH
    T10A12F793E5E420B3C2D3523F35BE2B2ED7B95335B0512C0483738A897A6947A6E38347
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6