Extracted

• • Target
    REVISED_CONTRACTS_20240530_JPG.bat
  • Size 583KB
  • SHA256 1b6304388826ef0f3c826c75afbe4ff571562dae466726e8d25cc93afb22ffa0
  • MD5 f41482940a8541117d885d640d8ef709
  • SHA1 c70609efae644cdaede26edeb34215ba67a3ec94
  • SHA512 c0e8486c399524d47b41e295fff87108ae95236bebd2c789d6048df3b7b93eaa05705e9a9e33dd4a039ae9313abe1810cdc29dac23cb2f4213e97a56012ead6d
  • SSDEEP 6144:wUjRwQGJaKitWD645y7qCjEXRF7PdrJNT/CcvuziDu7DkKlke:wqcS4IGCjEX/jNT/Cxwu8qH
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  guloaderdownloaderagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2