AgentTesla_064dba7cc3cac342ad9453aaca4209cd_exe_2019-07-09_08_30.txt

* MalFamily: ""

* MalScore: 10.0

* File Name: "AgentTesla_064dba7cc3cac342ad9453aaca4209cd.exe"
* File Size: 545792
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
* SHA256: "8ff1be33209d942bbb29a6fee112dd29e4570335f3b26d16900c314ce4fa8f87"
* MD5: "064dba7cc3cac342ad9453aaca4209cd"
* SHA1: "2d566e67b32b48bb335a784f99005f4c04bd4f62"
* SHA512: "9ba048983cf529383b77e93a38857433e4671bd6e3c115c826d3ae8b0654fd03e7294ef52ea5816c04ed0644f134c95fda7a50082f231ea1670a3267b40c363f"
* CRC32: "06C7F209"
* SSDEEP: "12288:sCLCOIrBVgD5VXOghFvbjGsF4wcN1xpBc6rea2T:sCWOCBKD5FBbvXt6LNDnBP2"

* Process Execution:
    "AgentTesla_064dba7cc3cac342ad9453aaca4209cd.exe"


* Executed Commands:
    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe \"C:\\Users\\user\\AppData\\Local\\Temp\\AgentTesla_064dba7cc3cac342ad9453aaca4209cd.exe\""


* Signatures Detected:

        "Description": "Creates RWX memory",
        "Details":


        "Description": "Repeatedly searches for a not-found process, may want to run with startbrowser=1 option",
        "Details":


        "Description": "Reads data out of its own binary image",
        "Details":

                "self_read": "process: AgentTesla_064dba7cc3cac342ad9453aaca4209cd.exe, pid: 560, offset: 0x00000000, length: 0x00085400"




        "Description": "A process created a hidden window",
        "Details":

                "Process": "AgentTesla_064dba7cc3cac342ad9453aaca4209cd.exe -> C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"




        "Description": "The binary likely contains encrypted or compressed data.",
        "Details":

                "section": "name: UPX1, entropy: 7.92, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0005ca00, virtual_size: 0x0005d000"


                "section": "name: .rsrc, entropy: 7.20, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00028600, virtual_size: 0x00029000"




        "Description": "The executable is compressed using UPX",
        "Details":

                "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x0006d000"




        "Description": "Installs itself for autorun at Windows startup",
        "Details":

                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\qckocvscrpgmsoq.eu.url"


                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\qckocvscrpgmsoq.eu.url"




        "Description": "Likely virus infection of existing system binary",
        "Details":

                "file": "c:\\users\\user\\appdata\\local\\temp\\agenttesla_064dba7cc3cac342ad9453aaca4209cd.exe"




        "Description": "Creates a slightly modified copy of itself",
        "Details":

                "file": "C:\\Users\\user\\AppData\\Roaming\\uqewlnruje\\qckocvscrpgmsoq.exe"


                "percent_match": 100





* Started Service:

* Mutexes:
    "DBWinMutex"


* Modified Files:
    "C:\\Users\\user\\AppData\\Roaming\\uqewlnruje\\qckocvscrpgmsoq.exe",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\qckocvscrpgmsoq.eu.url"


* Deleted Files:

* Modified Registry Keys:

* Deleted Registry Keys:

* DNS Communications:

* Domains:

* Network Communication - ICMP:

* Network Communication - HTTP:

* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: