Extracted

Extracted

• • Target
    Adobe.exe
  • Size 905KB
  • SHA256 e1bf0a90cc70db12ad9fbf3e5df672fac659c6a03857d01d9482fc8552b3fd55
  • MD5 7c6ad8d10fa26f8e64507f483f51ae0b
  • SHA1 752751c2f14af054f39b390d9551ddcc92ba27e8
  • SHA512 29ff5732057e996237a98a3dd50f7d2ee53ca84c65eafb2df9a6802dba1961dfde4f154686baf8919c78028ac2b7c0dc273ca4e51950863732ddaeafca27060a
  • SSDEEP 12288:+B66OufjVpNKUF3OjhlYnf8KPGNaTp7W7gMPWP++kQF+T11ft7KZVdPLpgOxwr:+0DsGQOjhlYUUGkp7yVuG+kQYNKLdDp
  • TLSH
    T13B15F149734948F0CC79C3379232E1478E2DAFE56BD1D62E10C176EA7B72789C6CA252
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncrypterdiscoveryagenttesladarktortillakeyloggerloaderpersistencespywarestealertrojan

  • Detects Darktortilla crypter.

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: Darktortilla

    DarkTortilla is a highly configurable .NET based crypter that delivers a wide range of information stealers.

    loadercrypterdarktortilla

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2