Extracted

• • Target

    b7e96f5e7dc899dc84e8eb7d63c867f38e8b742c2e44680dba593969ff148052.exe

  • Size

    999KB

  • MD5

    5c45c0877fb82d10594fde27ceef591d

  • SHA1

    ea68349b2af800d39680cf50da9e3284ec1d52a4

  • SHA256

    b7e96f5e7dc899dc84e8eb7d63c867f38e8b742c2e44680dba593969ff148052

  • SHA512

    d6497d61d8bbf155223fe4554783b0e86ab326ffb20bbbac4b444e0d27f16715458bf055085732c4204cbccba84419de62bd75615602a291e26c1dbc74a6bda9

  • SSDEEP

    24576:+YB//x9siaesoieYuVffHku3WggclxxIJzsGOB:j9//FAUHffHkumggclxGZW

  Score

  10^/10

  agentteslaguloaderdiscoverydownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    12KB

  • MD5

    cff85c549d536f651d4fb8387f1976f2

  • SHA1

    d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

  • SHA256

    8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

  • SHA512

    531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

  • SSDEEP

    192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr

  Score

  3^/10

  discovery
  behavioral3behavioral4