Extracted

• • Target

    Justificante.ex.exe

  • Size

    1.1MB

  • MD5

    4a896da2e79d9647adb4b9c7518d6a71

  • SHA1

    9569a9066aa22c7c0f7ab7de13e0901ebba2acb9

  • SHA256

    f223fc784ed382188a3cd4ffe1d6a641617e0738fc9e018680f739d982ae502d

  • SHA512

    3613beba76753955c4b0c165a7d3d82538cb5888470ea5e3dfbe9f412ec5238cc8f67ce477af96fd572344e026c25ef7f298e82e51837bd3f1cfc41a4e1c5405

  • SSDEEP

    24576:RV8oce+0nvEKaxHoioqmEwbfqiPACOedfHYNXNHA6u:RV8xjevTsIqa/ACOdHA/

  Score

  10^/10

  discoveryguloadervipkeyloggeradwarecollectiondownloaderkeyloggerpersistenceprivilege_escalationspywarestealer

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    34442e1e0c2870341df55e1b7b3cccdc

  • SHA1

    99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c

  • SHA256

    269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1

  • SHA512

    4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51

  • SSDEEP

    192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4

  Score

  8^/10

  discovery

  • Downloads MZ/PE file

  behavioral3behavioral4