Extracted

• • Target
    PO Medicus24 Zada Swiss AG.cmd
  • Size 666KB
  • SHA256 cae71b952baf0a2bcbce616bae7152a674ec2a23e0e5ca3f1bf5bd10fd13a536
  • MD5 260f1b5427d7d0fb3849a072686364e3
  • SHA1 9394e1d781c62b3d14763a3ddeef0f3a1cd2737b
  • SHA512 b802a6a3d917522ed18db77e78739fc69ce4e76717d80aa69caa93574f250beacc8f663794355d9b1d10bc96ed24ef468c454f061aaacdb9b65af69b0481df4d
  • SSDEEP 12288:RF47w5yB0pcQulmEUnXMF59Xct3oYGaioNFQqP72:Reay7QulmEUXMF5RKDKY72
  • TLSH
    T1FDE41216F6E88132C8B557305CFE07A70A36BCE11B3493E72B51B59A1CB36C4A93176B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2