Extracted

• • Target

    Understregninger.exe.bin

  • Size

    322KB

  • MD5

    4ab4a3d1894572436b1af077779f4051

  • SHA1

    271cd8521dab65d5a9d127c5296acea983d29512

  • SHA256

    f8082dc1210616c55008edc73e1ca4966cd8575e2425ed72f71f28b97f71172a

  • SHA512

    4564299080a7d763da23b2ececa16927c86e8801167e9bcb82a3fa6a78e322447ae8991a677d8bb4cd519c972c0157f6a966f7b2301a985c22c14e2b6460d2a2

  • SSDEEP

    6144:ex4veXIVOy5YUVFAEhpjyecwKz0CawKMeedSvR:o4GXfg1X1cw40sFPd4

  Score

  10^/10

  guloaderdiscoverydownloaderagentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2