Extracted

• • Target
    bc4b5891b1294dac280e9c24e2f63b8659d5703d28b7ffa459940b266f00b822.exe
  • Size 556KB
  • SHA256 bc4b5891b1294dac280e9c24e2f63b8659d5703d28b7ffa459940b266f00b822
  • MD5 21880c0ba2b22b64426bdc1db714d2c8
  • SHA1 f22aa32da4c1b64c15312009ddcb7dc6bf3e3cdb
  • SHA512 e71753652d3fd55ab1830cf5f93cd083731d1cccfe8a3b8b50a764020f1384b98ad64227b534a80ffdbcdb7cbeec217afec8e016fa0161b4a17e8b2c328858f3
  • SSDEEP 6144:PT4Dt9AZS49s1B6FIl+HFm2mrulGb40q6Z3DNW13e65HgU7IJYAFkISS8ozOMzDA:PTsAXF28crKGbJZTNihgU75AsS8oj4
  • TLSH
    T174C4F191B609D022DC171AB49123D6C28D27BC359BA1C833B1EAFB0F67374E25C7536A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverydownloaderagentteslaguloaderkeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
  • MD5 6e55a6e7c3fdbd244042eb15cb1ec739
  • SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
  • SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
  • SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
  • TLSH
    T1BE428D1193B089F2F590593805A67F2A6FBEAC5C27E44A63CFE345853D702DFA47A243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4