Extracted

• • Target

    SecuriteInfo.com.Win32.SuspectCrc.25896.32261.exe

  • Size

    707KB

  • MD5

    23956e32be182666e0efceecd423376f

  • SHA1

    2e00a592b4c2fa8b99b62eb9d0e886bfcc103dc2

  • SHA256

    a764b13001e6096c2ac36917bef4405ba8d22b6d06a5741f21977bf46c8afca4

  • SHA512

    abe088e593ea900b9ed622b7e1751b2d3f1287b6dc683b99ee76629f4a2c5fecf5a21065ac15e2d6b60ec15bef16f05c2eab31858d0a381f87318cdb3f19bb5b

  • SSDEEP

    12288:jfYRGeCHL7BTAIMMMgNTl+kVpMfynA4fA3Nws9Cn6oUisns52wA3ImBlVknu6RtM:jfYIxMMMgNTcv6nAUuS6fbs2wA/leliz

  Score

  10^/10

  discoveryexecutionagentteslaguloadercredential_accessdownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/nsExec.dll

  • Size

    7KB

  • MD5

    11092c1d3fbb449a60695c44f9f3d183

  • SHA1

    b89d614755f2e943df4d510d87a7fc1a3bcf5a33

  • SHA256

    2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77

  • SHA512

    c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a

  • SSDEEP

    96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA

  Score

  3^/10

  discovery
  behavioral3behavioral4