Extracted

Extracted

• • Target
    Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
  • Size 1.2MB
  • SHA256 26a229f9c3d82111d8a235e29cf7f594fc0f7e22b892d73a429afefa090c23ce
  • MD5 65477fcce7768974b86c665fbb010c64
  • SHA1 f1ad7d076e31f67960a8dd7649c196b95ed1d659
  • SHA512 4428e248c4bc3dd95f147178d7397a67cbe37083d7d44afe086452693414a13ac59f1c09b4fcf8b454d3e9dc299468c2cc4795d592c999a0d451ac0bc1b20bb3
  • SSDEEP 24576:jfmN3t/U1aLOEasdBMvfmIazWgOmkwuhv7NU6MFip87eYfSdsO4BjeX6g:Slt/UkLO5sdBMX8agOh7+7Fip7YfSds4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoveryexecutionphantomstealerpersistencespywarestealer

  • Phantomstealer family

    phantomstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.pif
  • Size 743KB
  • SHA256 2fda9ad52229d9b5f8f479c2d5a795e143283f3a8565eee7af2cb6bd68285838
  • MD5 2bebbf8027adbffeff9ca967a748db16
  • SHA1 c535bf79d6a9ec6214a2f185b4ff4277a4062249
  • SHA512 6e5bb971c5704c13b895dc5d8eddb5a1ce86d0dbc2b2e1abaa27235748692f3d2cac046f62e0a000b1dea917e19de354290bc8f031b5bccc60e615859aa43272
  • SSDEEP 12288:e+waXmqp8MQSqzWEbBjrDyX/hDLuhjLUiAo0m3/u7GVbFOxvD2LiMbCR0znWyykR:e+wem88BBVNjKXUv0m3gGVhOxvD6iMb1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral3behavioral4