Extracted

• • Target
    PROFORMA.EXE.exe
  • Size 149KB
  • SHA256 53cd75c785b440cbc32ded5c23144e59ec2d910618f3733dff686cefb699310c
  • MD5 981ecd99d8c5a0678120d153ef88106b
  • SHA1 0ce419c357d9db6d2828d3b8c301847209ffb347
  • SHA512 13b1a6e3178fbc203d96bb1cb42209af6d2dcd2e7fcfcedfb6630974ad5b39a59ee11e4c02e7b8b02554f22266c54bf03cb77ccc4d9e73d1d63127b14884a8e3
  • SSDEEP 3072:qs77w1OlWUt1uIkbkQhn7UzGyjRSbvzO6kg8u2KpkWoZfSCA:/mOPMkQnYa+Sbxkg8u9q3A
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaguloaderdiscoverydownloaderkeyloggerspywarestealertrojancollection

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2