Extracted

• • Target
    68b9ea322a8daecb51f6f58a54cd263fb4de32083a4f4ef53127dbb3760c6884.zip
  • Size 254KB
  • SHA256 f7f82d369aa58eed51d4756a1419649cf3c4efe35496999d9c08faaf293ba739
  • MD5 eb6d0ab329f0d9d7a2b72b8102120499
  • SHA1 3737ac14360a72e78a0f0bd8cfb6cfed290a2aae
  • SHA512 c0bf023635473d3a1c8cbe2c81f5bbbe3b688c9332553d2360911ac6dadfa2c4df398542e38ec38e9556c906959aeb00b3d550a8683c22a816054ffa8eba54ef
  • SSDEEP 6144:8aqSwKm8QQoAXia/bBLpw8HmVFGNzruYye9vnjws:8KXQXAyMBrmjYZBV
  • TLSH
    T1CD442362A963E08BDFA0912BFDB7DEC97ECCE44A5256107C4CB4B1021C253612F85F7A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1
• • Target
    68b9ea322a8daecb51f6f58a54cd263fb4de32083a4f4ef53127dbb3760c6884.exe
  • Size 380KB
  • SHA256 68b9ea322a8daecb51f6f58a54cd263fb4de32083a4f4ef53127dbb3760c6884
  • MD5 5b06bcbc0f81170cafdebd11877bbb39
  • SHA1 1e312c2ddd06649f2601dc88b2766df39d493961
  • SHA512 faeb419c5529a6836eff9124c809c88c0853dad33735c8ed1553cf67839cc64ae8c682298ab8ef90ee1e028508957354ff17a3e5f7cc702a7a5bf7ab3343f96f
  • SSDEEP 6144:mLsBN8xoInob4d/Opc8UkqEPgVmQbruy7W5l1IizIgx2VRygwF4PiB41E1y:RBSjApikqIx0Vgx2y4PiB4yY
  • TLSH
    T18E84BE4D71827692CED961F6062102F9936BEEFC601E533EAA623F17F4EA14121E2747
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoverydownloaderagentteslaguloaderkeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
  • MD5 17ed1c86bd67e78ade4712be48a7d2bd
  • SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
  • SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
  • SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
  • TLSH
    T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 c13104552b8b553159f50f6e2ca45114493397a6fa4bf2cbb960c4a2bbd349ab
  • MD5 42b064366f780c1f298fa3cb3aeae260
  • SHA1 5b0349db73c43f35227b252b9aa6555f5ede9015
  • SHA512 50d8f4f7a3ff45d5854741e7c4153fa13ee1093bafbe9c2adc60712ed2fb505c9688dd420d75aaea1b696da46b6beccc232e41388bc2a16b1f9eea1832df1cd7
  • SSDEEP 192:o68cSzvTyl4tgi8pPjQM0PuAg0YNyoIFtSP:LBSzm+t18pZ0WAg0RoIFg
  • TLSH
    T10A12F793E5E420B3C2D3523F35BE2B2ED7B95335B0512C0483738A897A6947A6E38347
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral4
• • Target
    Dementiets70.ned
  • Size 140B
  • SHA256 e9caa2effaab98350dd4d08c04599a3352b0d976fe10955f9019f949e0f628b3
  • MD5 9a996e81e97727dca3c7b31364a65534
  • SHA1 c22abcc993b485f26e071c323aec54f262187014
  • SHA512 da8ded048ac6b4f673a11fbdaec2e2ef7194882c7c3cf3cce9f2e245926c822e520e6daff9e1731cb85389910ec1f1d2db9dc43fd717ea9be2551185233dd607
  • MD5 SHA1 SHA512

  Score

  3^/10

  execution
  behavioral5
• • Target
    Mervrdiafgiftslovs.til
  • Size 2KB
  • SHA256 eacf13b423b5f6a9a514c854c9b3ab7141c48776bea2e1819db8aadd2dd037aa
  • MD5 b558af98de73c9b3d911a85a8a1963da
  • SHA1 716a563fa270a98e84a92aea43b4145d72d631bf
  • SHA512 5fbec504a637d1e6dc2d92db53fdb3ead67958550f11fd99c485e0a7b6366c7fd394cad5553a92bb5f40f5036de917beaa31b63ceb795519da94a21c29b78305
  • TLSH
    T16841020755285D555CB09325F21C654CE34F34E7D51594882BB13D4BAD47177DE233B1
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral6
• • Target
    Standardvedtgts
  • Size 118KB
  • SHA256 2d8ab284a74a7ea6f63d9512ede94344fa662d0cc80f01a48c41da8f30358926
  • MD5 85b99b82b559d7c18957d56764347371
  • SHA1 965d88116396e0e39848026aaa849063d33cca97
  • SHA512 dd5f982466cbd66e104323f22c6898b4a095c317f1d3cc384e14039b18a75639440d860e4224dd91a01e1ac87085c80662393e7ee3c5e22388da6c4c7ff12fd7
  • SSDEEP 3072:It6cEqrVVa06v7vb//FDUmhnCqYRLeYlnlUj7:IQcEK9Avj/FDUmhnChZUP
  • TLSH
    T1DCC3F1DAE841392DE95AEB136AF9C55100EC65FED9F1AF5C631C29D80F2012C7B87858
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral7
• • Target
    done.lan
  • Size 6KB
  • SHA256 d0e8314245fd9e81706b128915aedf60bf2c4f31150668babbff87143b570ed8
  • MD5 79cb10af4fa2b0e40e4611bb0f5fb510
  • SHA1 944432b53eb49d11357bcdb45b23c4a3fa1e1bd3
  • SHA512 47ae6f501a0bff4d70929a86e559bcad08a7427911273d2040621d214ad3d92597d68ccf9127b4da7ae1a1aaf5b67fb960511d28709339c708ea9b5e87e8856e
  • SSDEEP 6:IiNnlnWnn4nPoknKwnc8nC6nannmn+ngnes6nB:Ii19iqgkpfJnsxEe/B
  • TLSH
    T1E2E12344D5878848447855E1C77B46D5709C49315565431D517E66302D415544708D2F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral8
• • Target
    gratialernes.kon
  • Size 4KB
  • SHA256 71eaaec56a568dc38a441505c62a076bd6e0654e05b29994561a9bf879daa188
  • MD5 37f5770615ff11869ad32d3db28c5d2d
  • SHA1 6f95fdb5a7fe85155fe7f42f86aaace8414bc114
  • SHA512 4cf033f895f4205733f336daff84a5140ab14a810099eec0aaa8a525bf4b3d489354eb3fefeaae46dfd3b406bc7337b81af5f36662fb654f0e2113a200dfa5e0
  • SSDEEP 3:ffjfCzmb4zfhffKzFfuzyzVzfzzwKzbzzWzfxfZzfrzXWffVzYzjzXMffdzbEzb7:WihkGiKzX7KAff2zXAYz2OXd
  • TLSH
    T1F0A12BDFC097424B3324B3C14C50C061000BA2016C018003805A0A9D1005B049A4B03B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral9
• • Target
    ramosely.ins
  • Size 2KB
  • SHA256 a84f89d676a7c255af43e8ca48b9e7d7931108637d67863c9035f7ff504ca3ae
  • MD5 cc801675587f6f8031062d56d7926aa6
  • SHA1 8d801ffb800a1b70e07ac0888af2367418bbb61f
  • SHA512 8745ff429b15c43c7ac8d827dd5fa160f02f27a026c3ebeb6e67e2394dd4622c12ae34de52cf5f594ea12f1b0c6113e5dbdfdb2b0e5fc6a0e275362662a164cb
  • TLSH
    T16A41020080A08313A4B4C81494581224A60CC530C9C72C2141D020A0051122634D5058
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral10
• • Target
    stirs
  • Size 110KB
  • SHA256 f5c3c9daefdc50f7c0be87fa5dd09637612e7ae116aeb5d747b560fccc3fc1af
  • MD5 4a773320ae01b5644433b5db1789b172
  • SHA1 c34b302fb23781cc16a50158f458fe4998c29cf9
  • SHA512 8680a7951f73ff154079da2960ba2f0f6d6f85e85459b2ad913b7a50dc08b861ef79974905e5e7f23052bbf46f09368500d13253df826bf813ec0e93d0c11b5b
  • SSDEEP 1536:fpvrAqi2dI83cIgPISWxLMv1gbNJessMtEpA4nzwCMCYv0iir9:hk2oIzygRwhM20C7
  • TLSH
    T199B3B056D7168CFFCC06C538C47D22A90D7970165B4FC4BEA07AA914C18AAD37728ABF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral11
• • Target
    tapskruer.cap
  • Size 9KB
  • SHA256 e89d86756663803cbaa32b3729e8659fd8cb02bc78534d23e0d3f5cc603bc6af
  • MD5 50fd69d4a6eecb8a624389fab5150346
  • SHA1 5874e84165cc628cfa6e1c2adb5dfc39e75add4a
  • SHA512 fd8f06c49ad71ea755ad5bbece8089d2470e5ea3c7d33c307648c8407b7b9b1cb1a5de86b5d319942ef2f0ec31de819b1e805a1266137a452c4efe178649dd21
  • SSDEEP 6:jiWtkrmJjsuNttac5CyUA3yhHwGsYHWt/nFP4VAKY5abW/RYdWtO2WIQ:jDkrexDgQ/3CHwSHW5nqS5wWegBWd
  • TLSH
    T19C122B3A68F4649149EB33342395E3C670140BCC44574322ADC74460D91E05E2358D37
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral12