Hostile ^92% windows Download

DeskRipple.DeskRipple

AgentTesla infostealer payload embedded

AgentTeslaV3 infostealer payloadAuthenticode chain CN: .NET

SHA-256262c864bc83aa764d91d65bb7168f9cdc816ab17c46283ec341ea2ef0ecca1cd

URLhttps://github.com/DeskRipple/deskripple/releases/download/v0.4.10/DeskRipple-beta-Setup.exe

MaleculeK₂(AmLi₃)O₃(As₂DyEr)H₁₁(Cm₉Cr₂Db₅DsF₁₂Hf₂Mg₃Os₁₉Po₁₄TiU)Md₇(Bi₁₂BkPa₂Si₃V)Th₂

Evidence

Calls Windows GetNativeSystemInfo API 0x247fd0–0x248100

⋯5 more rows
0x24802067000000b700000009000000a8ab6600g.............f.
0x24803067000000b30000001900000054b06600g...........T.f.
0x24804075000000110100002700000054b06600u.......'...T.f.
0x24805075000000110100003000000054b06600u.......0...T.f.
⋯11 more rows

GetDiskFreeSpace API import 0x248134–0x248354

⋯6 more rows
0x2481946b65645c7061747465726e2e72730000ked\pattern.rs..
0x2481a430976400720000005d0000001a0000000.d.r...].......
0x2481b430976400720000005d000000300000000.d.r...]...0...
0x2481c45c2b41003000000004000000652b4100\+A.0.......e+A.
⋯25 more rows

GDI StretchBlt raster transfer API 0x4260e8–0x4261b8

⋯3 more rows
0x4261188a784200c2784200dc784200ec784200.xB..xB..xB..xB.
0x42612874784200aa7842009a784200b4784200txB..xB..xB..xB.
0x42613860784200000000003c7942001a784200`xB.....<yB..xB.
0x4261482c784200067842000000000050794200,xB..xB.....PyB.
⋯7 more rows

Payment-card CVV or CVC field 0x1efbfd7–0x1efc097

⋯3 more rows
0x1efc007b5f3fc9a914ad0f3f0854c6d56ca288d.....J....LmV.(.
0x1efc0174356563a0076a573d94a6d58e59cbf4aCVV:.v.s.JmX...J
0x1efc027c5c52b8f3218fe71de580fef16b859c0..+.2..q.X....Y.
⋯7 more rows

DJB2 hash (API name hashing) 0x369217c–0x369223c

⋯3 more rows
0x36921ac2e84c6534059db2530172cf7e5242cbd...S@Y.%0.,..$,.
0x36921bc646a623249abe632015bda6e9fc464c7djb2I..2.[.n..d.
0x36921cc648bcaeb36939665617018d91fd3e209d...6..eap......
⋯7 more rows