Extracted

• • Target

    19P3792A-M11A.01A_Z1_Rev.exe

  • Size

    603KB

  • MD5

    2990a924ed85fe8585ddbfc29495609f

  • SHA1

    742547f61cbbf617501d57d04105c38e2731858f

  • SHA256

    fb9fd24bd496e249c0cb281e033a661110c29885ab881e8185f4a25c6af5494e

  • SHA512

    3925734f029561f61f3c7921d6c88791d7415d95919b02d16435b0e362869d3a843740d0a0aceb8191b138d0b25dfa1b5fcf35eb71f4ebfb416cbb9605e7b241

  • SSDEEP

    12288:7iFZhAH10EjNRb8DpgXWHSaxSHesDW8lfHw:OFZ2HRjNKSqQWb

  Score

  10^/10

  agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    12KB

  • MD5

    e227391c7ff576135eac4871e78ebe2d

  • SHA1

    85d4bdbb79bdc47095ca35ed2141b2e64d029218

  • SHA256

    edf12a3040cff0d801a86c02313d6605b41d766807f3dcb261754cf01b4e14b9

  • SHA512

    06f1b65dd980c6aac17518faf34d200453fedf893efa01bfc71128ccb1a70abcd7165f581c9789caf80776fac313a4e754df7b58f7467930a666de37b55396a6

  • SSDEEP

    192:asA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:hR7SrtTv53tdtTgwF4SQbGPX36wJMw

  Score

  3^/10
  behavioral3behavioral4