Extracted

Extracted

• • Target
    Order SMG 201906 20190816orderGMD#0498366Deta.exe
  • Size 2.3MB
  • SHA256 a6dd827620007d29efb0f45a61ef6d7e1e6957d56103e8c61d6562cda8ef9c78
  • MD5 179e1628adcd4f90b64d8e8e7e63214a
  • SHA1 4636dac57ced7ebfdce05311cb48f16ea2059eae
  • SHA512 5eb7ac5fd8fd81c621457318b42b29e04e69c6f330fc8acc39ac65b39d0d4e6f698b16abd95fdf05da3ea04931b7c8f67ff07abcfb904bab023d5d581f14b23d
  • SSDEEP 49152:uB1BRf3rOSzOzrFNj8e1KbWF8K7Vk3SZTH4OWOEkw/R8VDYWg1Hpb67eQPVZD5bO:OaRrFCI2S7eg
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaredlinefozdiscoveryinfostealerkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2