Extracted

Extracted

• • Target
    DHL Air Waybill Number 290132721000000000000000000000000.exe
  • Size 513KB
  • SHA256 23f6c24a5984c1bc1450f2d6eb32f3ece4e52bc275b4e9eea038db9f7f4f7717
  • MD5 e7faf95fe72009e95bc98007a9204934
  • SHA1 9f8157036a2370a35d228af8eef12e4742bb888c
  • SHA512 08f69be1d7bb01912a8f17dc7f74a46a4398d272577b63c917c74e31c42bc64b7f7575589cbcafb3f98c794339222ff837dd663e4e21f3a3b9b654bafc1c0092
  • SSDEEP 12288:aSv6ymBW6V/EDp72+AfiCBOuGIcPp0vCphiFAV:3vaBJdg72fiCcfIcPp06LiFAV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaguloaderdiscoverydownloaderkeyloggerspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2