Extracted

• • Target

    Bloodlike.exe

  • Size

    750KB

  • MD5

    3471130ee839f6cba7abaf6111fa2d95

  • SHA1

    7a2222ba4034d054e6f976835e4139286f1d3d00

  • SHA256

    2147f70eb8ebf3d80eef30e2e6e9d75758294682d052a954af53510087bfa512

  • SHA512

    d6a93951f206174472377faf0b20df7fd5638389f4489b310d2679b91b3e6dba36a98dccd6f000adfbe3546238d90cb6813410b1dc3b1b355ee934dac79b7d02

  • SSDEEP

    12288:lXZEFyI2w//6CDquAh67/bAAkh9B9LbtS+OWbhxIK0Hc0CeD43JZHVDwrG8qjWK3:lXeFbRqkGhg/sJTthtOWb4riRVmqjWJ6

  Score

  10^/10

  discoveryexecutionagentteslaguloadercredential_accessdownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/nsExec.dll

  • Size

    7KB

  • MD5

    11092c1d3fbb449a60695c44f9f3d183

  • SHA1

    b89d614755f2e943df4d510d87a7fc1a3bcf5a33

  • SHA256

    2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77

  • SHA512

    c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a

  • SSDEEP

    96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA

  Score

  3^/10

  discovery
  behavioral3behavioral4