Extracted

• • Target
    INVOICE-6353535253535.exe
  • Size 608KB
  • SHA256 09ef2299abf773af4aacc8024ea8227e5c8777a2d7498c6d65f72dd52ce816a9
  • MD5 9d35f554c1062573ed54dbeca2a396f6
  • SHA1 689806fbb2becd0c22a1933472e90e9e6593808f
  • SHA512 cb8e887978f771976da6c33c7acbabab1c87323b4cca83ff0382988f3fe477e6006815417484194aace764d510cadc5dbc777af2a9dbc9fc869616bb2a6c8653
  • SSDEEP 12288:WVt4p363gwkHGBK5vC1FGxlMV+TEtKQPPDYDlANWRU:W/4lGJK5q1Ix++2KpDldU
  • TLSH
    T125D4220ABBD7CA87E8018735287584623AD6BD05A034D78723E47F7F7AF2A45560DB32
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderguloadercollectionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
  • MD5 9625d5b1754bc4ff29281d415d27a0fd
  • SHA1 80e85afc5cccd4c0a3775edbb90595a1a59f5ce0
  • SHA512 dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
  • SSDEEP 192:eX24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlqSlS:D8QIl972eXqlWBFSt273YOlqz
  • TLSH
    T1BD325D06235081F3E1914138846B3E175F6A15069BF58E97DFD38646BE30BE7BD79503
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 86c8ee210e6611383a634dcb8c60455063ddae3d7adccbeacf3adf7bf2a46676
  • MD5 d2e45dd852a659e11897df573832f381
  • SHA1 19990ee627c95b6c18d3b5c5f0ec5c24791d0af5
  • SHA512 93c9fa1767f3e861fe5765f2940aaba9eee6396d069c443ac6cbaccc88441b2bfc3c3af50a8044161f96bb7eb81af1bc6c1fa754d89740d0a2a8d591fef11073
  • SSDEEP 192:o18cSzvTyl4tgi8pPjQM0PuAg0YNyfIFtSP:8BSzm+t18pZ0WAg0RfIFg
  • TLSH
    T1A612F793E5E420B3C6D3523F35BE2B2EC7BD5335B0512C0482738A497A6947A6E38347
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6