Extracted

• • Target
    Quotation.exe
  • Size 1.1MB
  • SHA256 648ee80543d70f070c497309e4c7ce090254374da938799074de93bdaafaff5a
  • MD5 816b7984251ee4c846a7f0d6160624e2
  • SHA1 be82357d711260a412103e7fde8785febd060974
  • SHA512 81e035b9ffd16b8a31ab23f1d2bf621954cd42b8c0fdf0daffbac12f1964d41d949af68a06259e27bcc8163221cbfdb05f300eca7151ff901a2bcd36ca8b7a4c
  • SSDEEP 24576:G4nhDoAFAcvHumQbl7nu5v12dUC5YpdBNFQWEZNXLGQ7WczkxFnfbP9:G+hkJcvfyl7nu5vaUCMd5iNXKQKczg
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaguloaderdiscoverydownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9
  • MD5 d6f54d2cefdf58836805796f55bfc846
  • SHA1 b980addc1a755b968dd5799179d3b4f1c2de9d2d
  • SHA512 ce67da936a93d46ef7e81abc8276787c82fd844c03630ba18afc3528c7e420c3228bfe82aeda083bb719f2d1314afae913362abd1e220cb364606519690d45db
  • SSDEEP 192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4