Extracted

• • Target
    83bbfebbbaa599b1aee5e0140718c99726e133c2ce3968cfb6570ff746209284.bin
  • Size 123KB
  • SHA256 83bbfebbbaa599b1aee5e0140718c99726e133c2ce3968cfb6570ff746209284
  • MD5 1f7699e1f46a7e0c4ccc46b0d10b9c81
  • SHA1 829f865252ee6c4529e370a27bd2e279b0fd5b9b
  • SHA512 22fca8380fb3019611e17b6af0a13500203be79e2173a549bdbc3c29789e9199b847d7975699cb4b2809ba8b25bb10790f544328266bc9174b020c757133c2e2
  • SSDEEP 3072:9snZ+6aewVfDuL/p4djGN/Xzr7L0gAQsezSiJwL1Bnl13ebDqVJknOubN7bZT4Zh:ua
  • TLSH
    T163C39F95AAD7B13870B75E60EBA274960F6B7796B1354B1E30CC120D1FA3609C8E3B35
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2