Extracted

• • Target
    Justificante.exe
  • Size 457KB
  • SHA256 3bdc3b84e2970207b3e67191c3665ff676a5dfdab8331e4cd4787dee7decda82
  • MD5 d626ee1ad7c9abf27d97bcc0ed8d2152
  • SHA1 db9defd3b976c429e32d3bda89d93cecc7b6ba83
  • SHA512 915173d5abfeb0159e0193ea942561205f1136e7987658c7fe051d19bcb5233796f6ae9c764c42c3cbeb82adea938d7650b05eeae41c8936ed3719fec90e9277
  • SSDEEP 12288:ziD2LbgZ+UVAJZZcVBiB6at5W+x4sJMrZe+FoPT606:4hZTAtB6at5WKMrZeMQuv
  • TLSH
    T1B6A4F11A2FAEDD07E5939EB80A60D33A92B41BC059BDC7069F211D23797D7D36E881C1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverydownloaderguloadervipkeyloggerkeyloggerspywarestealer

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352
  • MD5 c9473cb90d79a374b2ba6040ca16e45c
  • SHA1 ab95b54f12796dce57210d65f05124a6ed81234a
  • SHA512 eafe7d5894622bc21f663bca4dd594392ee0f5b29270b6b56b0187093d6a3a103545464ff6398ad32d2cf15dab79b1f133218ba9ba337ddc01330b5ada804d7b
  • SSDEEP 192:cPtkumJX7zBE2kGwfy9S9VkPsFQ1MZ1c:N7O2k5q9wA1MZa
  • TLSH
    T1B2324C15031086F3E1D2853D682B39AB2FB969118AF04E438FB36952FE346C7AD79352
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4