Extracted

• • Target

    Overdue invoices list.bat

  • Size

    588KB

  • MD5

    b0aa6256cf3923d4077b54ecbd91dea5

  • SHA1

    328cdfcd943b424f3cc91e06616fa712dbbb55b9

  • SHA256

    a00bf3e3e9ca1d19b7f2668d143036aad1391cd8da67789da9843d08a0520768

  • SHA512

    f0879513b33e8bfeeec7569e1f1b830cc6a6dc39b27f5e53343804ebef52b087386accb1ca487df52c3fddb8307c250e767d67406c7f8a081ec7b0e8417ee730

  • SSDEEP

    6144:1p+ggBLPYy0WIFc5dRajUy/R4D7O9wWhrPtq+wHtWQscAElBPg0fVjjXTtqKdyn8:rzNWI+HGK7+tq+gWQ/TlzVjP0Ne0zBDg

  Score

  10^/10

  agentteslaguloaderdiscoverydownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    75ed96254fbf894e42058062b4b4f0d1

  • SHA1

    996503f1383b49021eb3427bc28d13b5bbd11977

  • SHA256

    a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

  • SHA512

    58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

  • SSDEEP

    192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV

  Score

  3^/10

  discovery
  behavioral3behavioral4

• • Target

    Langbaaden.Tik

  • Size

    257KB

  • MD5

    0b24239de4f08622c580128fb89f7dfc

  • SHA1

    e4fbb29a95f6c4c26ea8ee0af40e895434b0a3ec

  • SHA256

    a2db59ba324e60f92a800430550ff2d54e99ad4dd44e88037b297daa26954be0

  • SHA512

    fee733c6ef84ca8fabfe859026c3fd8eb7cd8b953980d37ed3333d468ed12739a9bd6956579a489b623a3d8c74d7fffa304f7b3ecee2216f9b32129efa81bdfd

  • SSDEEP

    6144:UESkdDbmtZnD2Vj7bLovRDuxYof+W4sMSq:vSkdDy7qt2d4Y04t7

  Score

  3^/10

  execution
  behavioral5behavioral6