Extracted

• • Target
    Adobe-Reader-v8.0-latest-installer.exe
  • Size 739KB
  • SHA256 47a05b7efdfad238172f1e804fb8a681b88281fae68e9a6efabe9b175c1572f7
  • MD5 ea4d51289540e3f418cff48fc0f8396e
  • SHA1 0a753425bd0b51897295ad85af3be6713f3c4cd7
  • SHA512 4fb55ed3d90bf47b23fcf558d045ef8fb05e7e8f7901e5cdcd6707972c0b7b6f675a7408462d409e7bf067028bf9f27187b7971ff03f23e44d1a9bfae81ae19e
  • SSDEEP 12288:ybSh1Au/reSjYYp3w1l3zO07iZBo7ZjqxE7iMK7x/n5HbbvC1pAFofnA9zEGG9Qj:ybS3Au/reSsYp3wasiro7tq4a/n1C1qL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaguloaderdownloaderkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
  • MD5 cff85c549d536f651d4fb8387f1976f2
  • SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
  • SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
  • SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral3behavioral4