Extracted

• • Target
    b288a3c462ac2ab4d11ee6929a8fe8e242ee9beb60030d54b9c3fa29a0ad153c
  • Size 441KB
  • SHA256 b288a3c462ac2ab4d11ee6929a8fe8e242ee9beb60030d54b9c3fa29a0ad153c
  • MD5 8ec5759d71b1e9019cc3611bb994fc31
  • SHA1 79e582670c8c1b26c4114f3f9c2f007a85971152
  • SHA512 1fbbe93e4fd1faa2f953667bb8c1fef7c7794ce6de04bdd74c11f3a0625267107c91948aa79cc80c3ea38718249dc8ca2e4f4c7047db7fd56d67d15d5bf7a791
  • SSDEEP 6144:GpkXGhIfigEMBI8Eh9xlgWAGWgPikKNxZh2TZ0UZjtYhA8vifv/w:/9KgEMUlgoZiVkxxOhA8aI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/BgImage.dll
  • Size 7KB
  • SHA256 8eb85584031b2e1d74daf372e60a72f767e8861db9d4ca2dc1981511f620e51e
  • MD5 744f9c42403e9aabde8fc65d40bccd3e
  • SHA1 9ab49924ffa1560e5e3b70b097236a1451945829
  • SHA512 924cacc1d1dd5260b6adf081bf1bfc83edaf51546af7e2f644ab53152e25889552fc99c50ddc45dc1850d7c165877637df11cd35709a49d57e6201b6f4690244
  • SSDEEP 96:8ewk1LFJaO1/radJEaYtv1Zs4lkL8y3A2EN8Cmy3uTu4j7J3kWyy/:tLTJa2roqJyA2EN8diuTfje
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
  • MD5 a4dd044bcd94e9b3370ccf095b31f896
  • SHA1 17c78201323ab2095bc53184aa8267c9187d5173
  • SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
  • SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral5behavioral6
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a
  • MD5 0d45588070cf728359055f776af16ec4
  • SHA1 c4375ceb2883dee74632e81addbfa4e8b0c6d84a
  • SHA512 751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415
  • SSDEEP 192:ob8cSzvTyl4tgi8pPjQM0PuAg0YNyhIFtSP:mBSzm+t18pZ0WAg0RhIFg
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral7behavioral8