Extracted

• • Target
    Understregninger.exe
  • Size 322KB
  • SHA256 f8082dc1210616c55008edc73e1ca4966cd8575e2425ed72f71f28b97f71172a
  • MD5 4ab4a3d1894572436b1af077779f4051
  • SHA1 271cd8521dab65d5a9d127c5296acea983d29512
  • SHA512 4564299080a7d763da23b2ececa16927c86e8801167e9bcb82a3fa6a78e322447ae8991a677d8bb4cd519c972c0157f6a966f7b2301a985c22c14e2b6460d2a2
  • SSDEEP 6144:ex4veXIVOy5YUVFAEhpjyecwKz0CawKMeedSvR:o4GXfg1X1cw40sFPd4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  guloaderdiscoverydownloaderagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2