Extracted

Extracted

• • Target
    DHL Booking.exe
  • Size 662KB
  • SHA256 e156c4e8e53c6b93166fea54fb521d9eb8bc74143ad52697a28809f5639205cf
  • MD5 661125400935a8e49af5c3e623510c41
  • SHA1 243966d2588d2bed628de929faf3712b0dd57dbc
  • SHA512 096b9112def152eba596006833b57a5384747b7866b8a5ef14312d8ea4597219dd700a7a0e723cbdec86c2ba22e8e9924abc7fe0a7f898eaca04fe361677f893
  • SSDEEP 12288:kq3Jx5eWUU771ONhglOHQQ08yHUKh4y/1zAUEwL2YDMGUNO/QhH1CRjU0u3FZWTq:nJDUU774hglvQOHU44y/10UE6RMGDIVD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  guloaderdownloaderagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    Spatel/Vredes/Tremamdswhisten/Subflavours/Chunkiest.Prf
  • Size 57KB
  • SHA256 492a5d0e26b266f1bfd6840679aa07deeba5d0bc851968fa7739073c82709f24
  • MD5 1e9c60c8a6dea5d7ab1dfc9b95b3777f
  • SHA1 31736a47e35f43915773a3f9997d743772ca136a
  • SHA512 513ac952cfb9ff4871bc49061205facc6541c2962ae9f7890713c1aeb88d211f992b6c5ae66571ee270fa2607a43f5981ddb6a5f409f408a9f9c532bfd9beb72
  • SSDEEP 1536:stR1IA96QFBOKPRmFtWY5GdfIRAn+l+EIqA1hG6WPZ:stRqMFoKP8DZGdfI6Y9A1A6WPZ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  persistence

  • Modifies Installed Components in the registry

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4