Extracted

• • Target

    PRODUCT LIST/DESIGN LOGO.exe

  • Size

    1.7MB

  • MD5

    97042a029def0b48a06a31d39d32654f

  • SHA1

    6ddba4f407409166bb39e03ba4d9ff528d38d636

  • SHA256

    bf9d54dce88b260dbf1ce555bd7abdd98b030bb3ee2170d51272c1b0ec8605a0

  • SHA512

    72f5a89e5c6e7d880c3d3bb39efea644cf402d80c6f9b9b771c2158e4e6095ec5aab9306aab8510a8b7bf1c7609f644fc8f24220e9260e247bbcdb3f07607e50

  • SSDEEP

    49152:WA6OSh5GOieweChL9K+Dg0CoGIlcYtpGdb:WAzFh100CwG

  Score

  10^/10

  agenttesladiscoveryevasionkeyloggerspywarestealerthemidatrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    PRODUCT LIST/PRODUCT LIST.exe

  • Size

    1.7MB

  • MD5

    a9b805862ccee6848ce91ef51a31f71d

  • SHA1

    4ca749b30f879945324811f5924996765aa7d2e4

  • SHA256

    9bdef064f9693bbae4a073b09a795c7b27e7486c10b3c7d920019ca3729bb434

  • SHA512

    94b6cc887127129a3b51dd68b8d29e417a70e7538668f5bfb4d5e1769d74e2ce44dcef9f36ab6021e04fb1e78f710bcc859163e064d91793e5a3b756fe067d97

  • SSDEEP

    24576:DRhMoSwfXo0P9Ej+zE2bb1SfyeeYF2yjfLV/JFzQXYiU4L/E/pWWG8WHHSx44s8/:DgNwfevYoaTerPtsYikWWG8GJ88Y6eb

  Score

  10^/10

  redlinesectopratdiscoveryevasioninfostealerratspywarestealerthemidatrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral3behavioral4