Extracted

Extracted

Extracted

Extracted

• • Target

    1be1eb3fc904fc5a9e9e555e3fa4a2b6a5a299917d5afa9a1570079195387fa3.exe

  • Size

    623KB

  • MD5

    8eab5e4d034fde42eb31add0cb923a97

  • SHA1

    ac9f5a051227302049aa5136a26f30a3707db55c

  • SHA256

    1be1eb3fc904fc5a9e9e555e3fa4a2b6a5a299917d5afa9a1570079195387fa3

  • SHA512

    54f6f28e0ad2ba4cf968fb766d000f97afb851a6886649c7968a39a3e09eff5974455164ba0e43963a1bc5a416b1fabfd6780c55cd794011ea474bd72c2accdb

  • SSDEEP

    12288:14uUdaP5mn0llWSQSSKJOzIT5HiSRJ56/:ydaP5mn0llNQN2OzCti2z

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    3b29f950968c3e659a25e4d65085b3c2337db74cfcc88fb7172971b1c3f13837.exe

  • Size

    270KB

  • MD5

    a2da34f16556914cfd1218970c90e451

  • SHA1

    9ac22b21244777d2d2b9ae22fb551f6a0b54f4f0

  • SHA256

    3b29f950968c3e659a25e4d65085b3c2337db74cfcc88fb7172971b1c3f13837

  • SHA512

    58b9ec3b661c1c1f636a64ed42af507ac8aafd771eb597952b7e76ec35828d26f7b41c0c8f1a87d5e0ffd3d328ed773b7d8ab2497d1e0e806dd4552056bcf948

  • SSDEEP

    6144:pR2kdN6l00Ul/YbyRVZXGoMFK0OK8yL7Ve:pRQ00Ul/YmGnFK0OvoQ

  Score

  10^/10

  stealcdiscoveryspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral3behavioral4

• • Target

    69cebec49aad7594157deb014e52b24580e3a6e05476aac000fd0cf7b1c3bd97.exe

  • Size

    6.2MB

  • MD5

    63de00cc272f7f0edb1669c406f97d96

  • SHA1

    ca46c7257e26654586d6348f7aaf618f208693bb

  • SHA256

    69cebec49aad7594157deb014e52b24580e3a6e05476aac000fd0cf7b1c3bd97

  • SHA512

    16796815b914363a61ae29627913b3f327b8bde98f78b2e6780f1c5fa4086464b45dee66799c637507f9a48d9be72598caea9bae2bef32ec17803fa9b14b7bd4

  • SSDEEP

    98304:jvV1BrPfhSqGzb7Jd8TGEjC6SZgeWxhLIzMwoUXYhLNfAMfv2goJMAWB72ozS2e:jHJPgqobVd8TQZaxRIHZCZoJMAWBv

  Score

  10^/10

  privateloaderriseproloaderpersistencestealercollectiondiscoveryspyware

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral5behavioral6

• • Target

    cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4.exe

  • Size

    738KB

  • MD5

    33a2aca5866de0f687e0d5d64c1feb9b

  • SHA1

    42c8a406496525574a3954a219968db17eb7877f

  • SHA256

    cb3cd1f7db0ac8ef966e513358935676673bd972b8baad11ef0f2a8bfdb9cbe4

  • SHA512

    0df31bd83fb732f9c228807b1ff0897a1f58198a3d9baf544eec95dbae2d19de490a47e2217455438eed4132fb6a5b5f834e74c8210d7741914cc74e4fd65cb6

  • SSDEEP

    12288:kI2ICYm2L/c37RaJFheLHUvGnJ6zsCMgzF+Nm3jZ738FQTft:AX27c3yQL0vyljgzAwjZj8C

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral7behavioral8

• • Target

    e164c86cf3eead4541a719f3cc5f08a7f0b36384fb8e95098116acadad23a69b.exe

  • Size

    3.2MB

  • MD5

    f23d61d5ff249493e4b55e0690d7b3e4

  • SHA1

    a6eccac18cc49aa7fe3863afb24d3975a5cf30a8

  • SHA256

    e164c86cf3eead4541a719f3cc5f08a7f0b36384fb8e95098116acadad23a69b

  • SHA512

    1782f63dc64baaf47d00ad0f8cf7d04587f8da2656aedf580147387df65b9481e4fdd7a4e34c6f01dfbefc4815d42a994dc7e6e065c84d2cf9821e602ac2446f

  • SSDEEP

    49152:3osVZWC0R4XRbTaDmixqWsOFQlrYQBDcLatzB+L0iVBH+nBz0I7C:3Z0RkRbTaDmcsOFQpEwIN+d0n

  Score

  5^/10

  • Suspicious use of SetThreadContext

  behavioral10behavioral9