Extracted

• • Target
    Directrices de políticas para empleados_2026.pdf.exe
  • Size 370KB
  • SHA256 1d47d23590a3fa04729bb611f7b69356b47639667b83cdfe38eeee77e7f1601c
  • MD5 9b76d12f3786d918ffd01eefedd10026
  • SHA1 39f24666b2fcff117ed4526118a44d6853cc2a82
  • SHA512 6ef3d29c3205aa54b2740a51cb5b0b3b5657db4c86c40a67938fe98e881a425405e0eaedd729c7de0c98be842c24f7197b2eb308e8317b2fb412096f440c606b
  • SSDEEP 6144:SMm4CCEv3liZFEDwxQRy4Cm4k2WQ5s9PxMWJ12VkqoutiE/VQxGlXF+kY3N4:SMw3v3lisDpRfr4c6iPxMWJ1MoKisyYl
  • TLSH
    T14A84128220B1C43BE5F44E31C97A67F96096FD1ACDB21A4767847E6C74712C2BE0EB24
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverydownloaderagentteslaguloaderkeyloggerspywarestealertrojanadwarepersistenceransomware

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/LangDLL.dll
  • Size 5KB
  • SHA256 09acfc5ee34a1dfa1af3a9d34f00c3b1327b56641feebd536e13752349c08ac8
  • MD5 014a3be4a7c1ccb217916dbf4f222bd1
  • SHA1 9b4c41eb0e84886beb5591d8357155e27f9c68ed
  • SHA512 0f3d1bf548e29a136150b699665a3f22c6ea2821701737363fa2920b51c391d735f1eae92dea8af655e7d07304bd3d06e4aff3f5a82fa22bcf5d1690013eb922
  • SSDEEP 48:S46+/iTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mMofjLl:zsuPbOBtWZBV8jAWiAJCdv2CmfL
  • TLSH
    T143C19470F3C248B9C491413368E737D36612EE746784500F9B6311AA38209E7AD3EBC3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
  • MD5 564bb0373067e1785cba7e4c24aab4bf
  • SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
  • SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
  • SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
  • TLSH
    T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
  • MD5 48f3e7860e1de2b4e63ec744a5e9582a
  • SHA1 420c64d802a637c75a53efc8f748e1aede3d6dc6
  • SHA512 28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
  • SSDEEP 96:oFsvUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YuNqkzfS:oFsvWyNO81b8pCHFcM0PuAgkOywIFc
  • TLSH
    T19112F992E5A450B3C5D6533A35AA2F2DCBBD5329B0926C00C7738E4D39355B66E38343
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryadwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral7behavioral8
• • Target
    Trafikaare/Ingenirtropper/earthpeas.com
  • Size 79KB
  • SHA256 ace9185e1eccd2ab2038e0f722ca2a234a35ae7bfb732dc8a6534ac57c37abee
  • MD5 110232d85146372234b94ff18b6ca936
  • SHA1 7a668c4387095ec91c3c336766db1dfb17e575a5
  • SHA512 3676132117a8b69d7865d85dd93db0ca6ef96010418a787277079a5c6b3699e2f4490badfbda33460b5e50af28d98b04a2a3c51e47097743fbbeefff975a5bd0
  • SSDEEP 96:tfe2zfpZMOjwZ9AyX7yww9sePY5w5Fts0UQd2TFTw:NBH2It
  • TLSH
    T1BA835BD3B5F06CA64A6CF3C2944AF55042991517FC0CA14E28989C476DB73213A1DBCA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral9