General
-
Target
19092024_0039_18092024_Bloodlike.gz
-
Size
688KB
-
Sample
240919-azvyaa1gna
-
MD5
4d889df0aaaff199fc81ab2e7e537691
-
SHA1
1f482370a288d3bb9a1a9141421ce469362fc16a
-
SHA256
3ed15d1915a0408416f2db5a1c89a8b628b73428f3f768ae5ded17783f88ea27
-
SHA512
7b7439528dd4b98a28fff3b72607fad6b041d2b8b746736d3b1ca7941c4ef7b93e8de451096b52837920d230dd1462101392b4d79d4360056e92a6aba64ac6b7
-
SSDEEP
12288:iilMWo3J0//6gDQuAb6f/LA6Oh9P9LhtS6uWbhLIKinc0CeDu3JZXjDKrGWybWcF:iilHo3iq2IbW/cbVtDLuWbILgRjaybWk
Static task
static1
Behavioral task
behavioral1
Sample
Bloodlike.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Bloodlike.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://mail.hearing-vision.com - Port:
21 - Username:
[email protected] - Password:
LILKOOLL14!
Targets
-
-
Target
Bloodlike.exe
-
Size
750KB
-
MD5
3471130ee839f6cba7abaf6111fa2d95
-
SHA1
7a2222ba4034d054e6f976835e4139286f1d3d00
-
SHA256
2147f70eb8ebf3d80eef30e2e6e9d75758294682d052a954af53510087bfa512
-
SHA512
d6a93951f206174472377faf0b20df7fd5638389f4489b310d2679b91b3e6dba36a98dccd6f000adfbe3546238d90cb6813410b1dc3b1b355ee934dac79b7d02
-
SSDEEP
12288:lXZEFyI2w//6CDquAh67/bAAkh9B9LbtS+OWbhxIK0Hc0CeD43JZHVDwrG8qjWK3:lXeFbRqkGhg/sJTthtOWb4riRVmqjWJ6
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/nsExec.dll
-
Size
7KB
-
MD5
11092c1d3fbb449a60695c44f9f3d183
-
SHA1
b89d614755f2e943df4d510d87a7fc1a3bcf5a33
-
SHA256
2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
-
SHA512
c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
-
SSDEEP
96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
Score3/10 -