Extracted

Extracted

Extracted

• • Target
    Invoice.exe
  • Size 502KB
  • SHA256 24fb7946550f1ce880b6e96318c2ce6cdb993679db6a9e2c34c6e809fab35c64
  • MD5 904caccef3f65e9229a12d2fe7b7041a
  • SHA1 0f9c30fc80338e85bb20c047b30885d4c3adf5e1
  • SHA512 0a95935977872eebe60ca83c58ae25338d68792a7e86bbf5605a8a4219deaf67e9418b187fa4e0444277d69c20e67f703e7cea3cc1d2c588bc0990b8c80c6bbe
  • SSDEEP 12288:vFda+Fda3FQMGhfwkD3gDLWCIWBz18taUAf:gFpGhfw+oCZqOt
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops startup file

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    Pics.exe
  • Size 806KB
  • SHA256 20f5a9a0987d95a8b22df5c60e246d85259ec8893d0d6f3c7fdfeecb066e6b07
  • MD5 676dda52e0fec9f49caee414127de4ef
  • SHA1 6d95db4649588997b3b53b5e95aecb67047ba3ae
  • SHA512 ac1dc1bc932c503360119c713b3ae0d81331f1f36838e2b26dab1c8a80e5c4f7df57df19ad6c59cbc8f2f77d02f77fd9f9919cd5be8310ef17ce15d25126ccfb
  • SSDEEP 12288:fFda+FdaiFQMGqfwkD4KyN5U97OlIhvGPC10KnLkwvsdir8EwBxAOpWerOR8AtsF:VFpGqfwBtN0j10KLkwQiYHsv6At
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  hawkeyecollectioncredential_accessdiscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Drops startup file

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4
• • Target
    Products drawing.exe
  • Size 501KB
  • SHA256 1339a751e36cce726e3d808cfad7cd81c7f0712103a9c26a65acaf8c573f97b5
  • MD5 59eb6cff844446f0e44f2d3d85f85a9e
  • SHA1 c0f7887016df63c80647c4fca82b979dc18ff010
  • SHA512 456f66a52e7fab312d226be645d4543fa9156944fb1fc7265aa75a316c29aa6f994cf3e2eccc93c2837b9b9c9f904b2cee7e08078604d51c7496f11635948f2f
  • SSDEEP 12288:XFda+Fda/cQS84fwkDB1vSYVGJRu1ujK8q+TXmXTtt7Af:ccn84fwE1fVaFK8NSt
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops startup file

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral5behavioral6
• • Target
    Quotation and Prices.exe
  • Size 730KB
  • SHA256 abfc5a0bbf24e3dbc1c76c0734ea0b1ed6a0d5ff6f44f2a5a3e4e2f9317118c3
  • MD5 6d991f93327f70488011bf06ba799930
  • SHA1 1b630a8c337cc48f9ec41cccc4352f51e7d51e71
  • SHA512 181be4ad5a549d51461fd8c9a470abac2895f51b5ec1cdba6927644ca0e8fb91663d8635ed5c98f4a90ae2752eb98b3235f106ee2d009cc885bdf6d0faadfe70
  • SSDEEP 12288:tFda+FdahcQS8zfwkD/j1UGmy7eaqwVlXN8eR5dKFLtnoAf:8cn8zfwa1Dmyxrd8eqLt
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  matiexcollectioncredential_accessdiscoveryexecutionkeyloggerspywarestealer

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main payload

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral7behavioral8