Extracted

Extracted

• • Target
    Nuovo ordine0029338476.exe
  • Size 361KB
  • SHA256 9992545ef435706e582bd516988195df8bae9985ff70d30ea2c20dc5206dfe3b
  • MD5 b7721cf13508b02083feb0b010534423
  • SHA1 33ca049d12dcb1f23ba998abb11d08110381ba8a
  • SHA512 1009df4e212901c3001e84c9f9c096c182ef8c7053f5622a13c38e30133563ad169898cd83edd0120826d880d116569723287e7c04d3b9760a0fd240c0f42a17
  • SSDEEP 6144:9R+xX+sywYL1S44ElKx5aEasbpK//pUVwnKG:LkiL0Mls5sAuGV7G
  • TLSH
    T15574E990F249EC97F41615B64D7B9521148EA398D4B9C31E2097B72A6AF334230AFF4F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverydownloaderagentteslaguloaderkeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
  • MD5 0d7ad4f45dc6f5aa87f606d0331c6901
  • SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
  • SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
  • SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
  • TLSH
    T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4