Extracted

• • Target

    justificante de transferencia.vbe

  • Size

    392KB

  • MD5

    3aba5da8298f10ca1e3193071be5461e

  • SHA1

    f70b104613bd4a485f9adc5b08d7c7a9554e8cf6

  • SHA256

    6bf0df73f3e4a982cafd958bdba0a8a28298390a77fc1a579fad933d5b6c1a00

  • SHA512

    e0277cc9085413a300ff233538e9e4080493dc93d6efb18b142d24acbd16e3febd0e70512c08dca1cb1c1ff385aff77ce944eccc9b92ec40ed55b4f9ce9897fe

  • SSDEEP

    6144:JVgYp89c7jC2cLsteSlauli+UabHx03WwbfEDP9C8R6UdoVau+:7gpqjCckulbUabRA+PV4guaV

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2