Extracted

• • Target
    27062024-322copy.bat
  • Size 873KB
  • SHA256 76f267de8fd5fa4744fb8294ee9a4765afeba03b36244527feca60a32df155af
  • MD5 a37f4e7d2f3ac6c995f1986fcc9bb48f
  • SHA1 4e922eccec03db2683096b531801c73227e5ff42
  • SHA512 2959cca5d24deb57910fdd7ae9baae27c3bd0790868730477391e0a7e42fd8aec21225e902c96e46ccd23c2d3b80f8cb9a43d3d4e545fcd2c1d083564d2869ab
  • SSDEEP 12288:XcIjd3nQIQsk3na+Qin2At4FhujlTdp6c4TgONNER+NzYCzXBl5GgCWr2mS:XcIjUna3in2o4FulG4ONNi+NBNlY2amS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8
  • MD5 55a26d7800446f1373056064c64c3ce8
  • SHA1 80256857e9a0a9c8897923b717f3435295a76002
  • SHA512 04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b
  • SSDEEP 192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral3behavioral4
• • Target
    Disintricate/keelhauls.scr
  • Size 1.0MB
  • SHA256 66bf6c84307739696eb18d632b6a34755375e61f3c612dc273c7f8f25fcad938
  • MD5 87a3ce82a211e6022d7145c99eef5edc
  • SHA1 d2aa5daef3272acdee40657353ebb0ba94728e8d
  • SHA512 66f2bc1530f6d187749486c7305f069d67964ef5427a6a59f2dc081469f5d608c6e0d2c30edef70a6a79e6386be1528ae2b8725ba704e2d3cf8b2f303d8eb1cf
  • SSDEEP 768:N9lotXK6U6HA/zmsIxzvraRwfj+iMbmwrhg2hnwjYBm2GOP9bsWZafCJL6Ir7wxG:QRPMLzJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5behavioral6