Extracted

• • Target

    Detallemovimiento.vbe

  • Size

    383KB

  • MD5

    a6da9c70f7e088ecf7247a85e8bfedaa

  • SHA1

    7fad311cb273cc23d394a8546cef38618b221a14

  • SHA256

    8597794c544621c280d7d11fddebae50a4abbb7e8c9a0c4b9ac281f24af02119

  • SHA512

    4fad8beeaa20d0ce0b87794c941df18dce815f66244c2678ca5b0d9efb57f03472387f36722cf28f57b303b58666a567bd3dcbb0ab03aad662c24f66bddba93e

  • SSDEEP

    6144:JfEUAozWQzbmRFsZNgLPttbCMcylU3pS/VGyWwbfEJ8km/UdoktuN:JsvyfmUoLPHmyK3eX88kWgRt4

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2