Extracted

• • Target
    d19a52218523096921521d6aceb4575c0773ee7f062cddc0aebb054ce37455db.zip
  • Size 4KB
  • SHA256 cb8a0e9f841a1e14d070d1f70ec2cf570f2ee0dc8b3a80a97eca94fb6a41efc1
  • MD5 7d365f85936054e9042787db90639354
  • SHA1 8dc8c7255d57dd615989744ad9e539c5c0956ba8
  • SHA512 27c0fddb920b7426046c000e944a7a39e56a2b85b06bd4f55821610db17a8936a8ae566088162ac00cdf309319e15e55a49303e5ab36a54e3ff7285b21c9b560
  • SSDEEP 96:u8XVbIbTpuX3LWVUeQkslK0qujKYCaNi7NaapRJzV3L8XQ:unuX7HK0qcC/7QQzLZ
  • TLSH
    T107816D1F0278843D5EB8A0E95DDCE5C8C0DC4A5BAD06E427691E462C4DBFCD1905F9DE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    d19a52218523096921521d6aceb4575c0773ee7f062cddc0aebb054ce37455db.hta
  • Size 31KB
  • SHA256 d19a52218523096921521d6aceb4575c0773ee7f062cddc0aebb054ce37455db
  • MD5 9fa6552a0074b87f21d839986e80da6c
  • SHA1 0dd1f2eac74a73c5afb3a666fe891413b4111fb4
  • SHA512 f3deffb910ef6def9efef8bad210a4a38abb41b3854dc711d250cf00b6aed7f0dd54f51c2bf801f76f334fe7a90d96a5f1c55ab76729703e50e431d39723c6d8
  • SSDEEP 768:F0EYgLe2WFZLyXmb8SF/3y86p+uC3iD6CZwi:F0EYgLe2WFZLyXmb8SF/3y86p+uC3iD7
  • TLSH
    T120E257009C5E026868619E8A57D1453DAD423B30A3FE9E15FEDC2E8B76221ED35CECDD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral3behavioral4