Extracted

Extracted

• • Target
    0092837465509072026.exe
  • Size 331KB
  • SHA256 b134896ab4f8a75cb79f559a1f3aa65b5cae52a3c39fb95ac8371d600c2c92a9
  • MD5 2d569c5eaec74172ee46fb7af42962fc
  • SHA1 60e26cfee4817ebcdfee1448396ef6e6a9b05469
  • SHA512 97e8995bd4244316888b7649ba741123cc8eebd824365e8d994caf8f98dd136a3fe9763201a9b2a6dac8ff50b0ed53c8de96afaa1ede91a2e1294d8acfd6ff45
  • SSDEEP 6144:EgORaspjQel+F3MjvEypW/VFNUCFIrsai8:Egyjz+F/gW/zNUCF7ai8
  • TLSH
    T12074C0A1F299C8DAEC52227158BBDC3315577E69B875051F312F3629ADB33C3106BA0B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverydownloaderagentteslaguloaderkeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 b7823a15e7b1866ba3d77248f750b66505859d264cfc39d8c8c5e812f8ae4a81
  • MD5 a1da6788aeaf78ca4ae1dece8019e49d
  • SHA1 d770155e6e9aa69223be198c44a8da26a1756d89
  • SHA512 eada9c1528563ddfe3d4d8ed5dbc52b85a9190765535b68da90e6d623288bf0090adac5118e1ed6e3cb3e0abb9af025d3a2a73121413a4471a90fd04bc861e18
  • SSDEEP 192:uenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBUIwL:u8+Qlt70Fj/lQRY/9Vjj+L
  • TLSH
    T144428D1193B089F2F590583801A67F2A6FBEAC5C27E84963CFE341853D702DFA47A243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral2
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 48c290cf400a8e3a5e6cded2f4817d344c4d20745c8659cccbc09edad5866dc0
  • MD5 9cbefc918a4560f3e780bc927e0e4008
  • SHA1 4c23e9947f5d2338b4cfeb870cc9f9dcb7ee37e3
  • SHA512 7a11aeba9bfe309c9baaa9bd907218b238fd09a98c55c5d34949b8f5b4b6402e3efb7cb3279c211459cb6d27b689896c0a54ed92155d25f5828d18377a5b4bff
  • SSDEEP 96:o1svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YrJNqkz6:o1svWyNO81b8pCHFcM0PuAgkOybIFc
  • TLSH
    T1E512F992E6A450B3C5D7533A35AA2F2DCBBD5325B0926C00C7738E4D39355B66E38353
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3