Extracted

• • Target
    a1ceb961c3797e6999092bc934714401ac7dd83139223ecc8b5e5b2c08e79c5c.exe
  • Size 489KB
  • SHA256 a1ceb961c3797e6999092bc934714401ac7dd83139223ecc8b5e5b2c08e79c5c
  • MD5 3ae03f156f2c2f54e69bae05694b5f6b
  • SHA1 029b4f886bde1804e201db5bdb261af41de18b72
  • SHA512 718c60da14143d0296fa8a88f434810c6ab85457cd0f53ab3cd02f76a03ad8c6cdbca39351767b01fee4253b5347c080af0c9cb74d83171371dfc383db7d7177
  • SSDEEP 12288:SkBMrvGE8rgEcnjhdXb/ln/TP81yN6qfk62fSq11j82ntN:FBMrGzrlqb9Y1qvpaBj8cT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
  • MD5 9625d5b1754bc4ff29281d415d27a0fd
  • SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
  • SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
  • SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral3behavioral4