Extracted

• • Target
    rcncmasOrder.exe
  • Size 770KB
  • SHA256 252c26a5ea749569e41b4ce291ea4ff21d08ca884123c8ff171433a359455033
  • MD5 c0b35f4104c86a49e25177941d7a7014
  • SHA1 8e5de6ef45ff073ea5c23177b12f40ec2b439fad
  • SHA512 b224fa66a6a3b1869bebf79070b81d08a77d41a1f2eab100f649c6b6ef6c48b29fe5bb473e95c07cd7548eaf4d5fc6a32110fd9d7332a0f6d90af0d3ba07eb7d
  • SSDEEP 24576:8e8hwsezFUtA1WKuRRaDSt/R7S6dYnzlzmZeR:lsezqtlsmZgzlQq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaguloaderdownloaderkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8
  • MD5 55a26d7800446f1373056064c64c3ce8
  • SHA1 80256857e9a0a9c8897923b717f3435295a76002
  • SHA512 04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b
  • SSDEEP 192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral3behavioral4