Extracted

• • Target

    fordanskningernes hildebrand.exe

  • Size

    684KB

  • MD5

    8db600d5b4168b5d358209fa4b85bd5f

  • SHA1

    d6822e043548fbacd692a14d7dc17250482c43bc

  • SHA256

    2ef9a5215999c03ea03636ae06f8c66b3ed1274153bdaec215a189cd148669b5

  • SHA512

    c2103215579019f69aa3e4adfa2067d90c9189c093c7b065e9693e3d8745f084810e7652dd0e2e6638eecc18344641aaa23460eb2799c3829b73462b08f741ca

  • SSDEEP

    12288:swFGHEDwfu4MFVS/GCFj+an2ry7/hFwz7ylgimtdYM3O0V7bbj:s5HEMfuDDSuCF6an2rg/hF7lgZtub0Vv

  Score

  10^/10

  agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2