Extracted

Extracted

• • Target
    Order-1004552_2026-10-14.bat.exe
  • Size 820KB
  • SHA256 4aae156271039997062de8029d54ab346696d29e92dbd52ddd54a0f800801ec1
  • MD5 daeaf107c068d6d165826c674404485b
  • SHA1 86f2f5eb54aeb9b17fc21ae58816ba0106bfeea4
  • SHA512 9273420158066e6bce4e8028051e9f15e0af93d6faeda56228caf3f3a48b3f1d8ffc7233dbac2f32385696a75843facc34094f7640d29d003e8f1d153ca5682a
  • SSDEEP 24576:kYzslG0Fp3wm2La+64xCjUNPixeunWhFqoUBTjr:tJMuae5N6xeunWhFqoyTf
  • TLSH
    T151051221B7FD894BD5645E758CE45E106FE0AC015926A2C776ECBB9FAC333838C06792
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoverydownloaderagentteslaguloaderkeyloggerprivilege_escalationspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 12KB
  • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
  • MD5 cff85c549d536f651d4fb8387f1976f2
  • SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
  • SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
  • SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
  • TLSH
    T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4