Extracted

Extracted

Extracted

• • Target

    Inv.exe

  • Size

    744KB

  • MD5

    f8433b692958fa0ce7659e63203b60de

  • SHA1

    dd6595d2e6d5bdf54e718b07c94fc964eab69365

  • SHA256

    69b49da3c4767d2ffcd713aeea8343e1aa2f0be88512fc9c4d86a932b4ee6cb5

  • SHA512

    343ab88a59614251a2323af2b886069e5507aef04421c1b937661868a4c1c3332c60af85307b2b4dc21632c983e85372486ea6f5adfb3ffefeb11cb186718a6c

  • SSDEEP

    12288:CopQ7vrfwkDb4lFH+Ke/zromd1UUdR1QeFVzXShXjgR8A52GkJnftMZ:1pavrfwRlFUwm3UgDQ4azRAUft

  Score

  10^/10

  hawkeyecollectiondiscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Drops startup file

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    New Order.exe

  • Size

    439KB

  • MD5

    cfdf487ec65b12fb598214e07d4e2449

  • SHA1

    1a4c51f0f4d6356da677594800b4356c65da6074

  • SHA256

    bd021089d05bee433a76c55dd186d23261a7232e55ea540c9fd63f4403071a66

  • SHA512

    afb4fc6e187ab62f29adfef8390b74db3ba309c37fb8c57c38dd8beeaba74c11ea58643f45d9349206fdca0aaab567e067fe555368f44bdcb0401c8da0f81009

  • SSDEEP

    12288:FecQS84fwkDIvgiFZyINBQ07P+C+g3tJ:ocn84fwjnZyoBQ07L+0t

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Drops startup file

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral3behavioral4

• • Target

    Quotation.exe

  • Size

    440KB

  • MD5

    0547c6fd5e4d632b87d2f9a3dbc88587

  • SHA1

    022d3a644567f960a1fa692ed576a4aaf5ca72a0

  • SHA256

    e25588ef7f6dc061277b4380dc1f9ad034f1eb74c254cd778fea2ab7fe1783ab

  • SHA512

    bed9caa917ff25a5168017952b401f4688f0f04c0075442bcb95d891017293b403c42a1e6f43cea4fc6ee5e2e80ae90d4c19afc293283eb4e840bc8871878129

  • SSDEEP

    12288:lmFQMGhfwkDlqSagxLFfK9YwxemjVaJW7Jt4:EFpGhfwura689YwEmjVeOt

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoveryexecutionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Drops startup file

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral5behavioral6

• • Target

    pictures and logo.exe

  • Size

    669KB

  • MD5

    4fa42a8beb305337e28cede06ceefa62

  • SHA1

    1ad401dc70385788123ae837eea020a9c1d9e9d9

  • SHA256

    c38b853587846014052d5b2206e8764dac66f7de9479ec3080e1872938bd7ceb

  • SHA512

    81dc56b84e3e95169de458d5842c50347455365388b96155aa25a7fea27dc756d20180265ee2b796b2d6ebc2d04d622a6fa9259877f371e956e1458415046807

  • SSDEEP

    12288:mEcQS8zfwkDWsWUZT3HVCuNhzmSEuH/KVTXr2tb:Fcn8zfw+WUZT3HVCuNhqWfKFXr2t

  Score

  10^/10

  matiexcollectioncredential_accessdiscoveryexecutionkeyloggerspywarestealer

  • Matiex

    Matiex is a keylogger and infostealer first seen in July 2020.

    stealerkeyloggermatiex

  • Matiex Main payload

  • Beds Protector Packer

    Detects Beds Protector packer used to load .NET malware.

  • Drops startup file

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral7behavioral8