Extracted

Extracted

• • Target
    Catálogo de reseñas de productos.exe
  • Size 720KB
  • SHA256 bb74d83e3d4f2f4fd4db9202f93d0ebb0ec2ab548889d0a7715d8962f85609bc
  • MD5 2dbc1098c01f9bd1da3a31858b54f0ee
  • SHA1 87d79373ee7855fd018d3d003d63b862f3018c91
  • SHA512 2ed146b9199191407d12e87d35888675f2829fa42a5399d9232966ea92900ecbf3e42f49c71ec7c56889b95c3240200c14001b9d57878ad694514d1908b93954
  • SSDEEP 12288:/cB48pn4dJlYtOXL5UWBWG25VWQe/Up2C3jKhtHbcrcnDuWk64:bSnCvYwL5UWBH25VVe/yB3j2Ui4
  • TLSH
    T1CCF4F1142BEA0F55EA7E6B7C9570012907F6F503DA23E71E6D9920EE0E33B81CA55723
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectioncosturadefense_evasiondiscoveryexecutionagentteslawarzoneratxworminfostealerkeyloggerpackerpersistenceratspywarestealertrojanpyinstallerupx

  • Detect Xworm Payload

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Downloads MZ/PE file

  • System Binary Proxy Execution: Regsvcs/Regasm

    Abuse Regasm to proxy execution of malicious code.

    defense_evasion

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2