Extracted

Extracted

• • Target

    justificante de transferencia.vbs

  • Size

    124KB

  • MD5

    2c5add519c94bcfa2e7c1064ceb64736

  • SHA1

    af99c8f0fb30a9a4fac437aa427ef44e41b535f9

  • SHA256

    b916b37fcc5b1f5a77f6ff3c36904e9f20cdea77266acbe3566f3459d8c1f1d0

  • SHA512

    7fd3feb9ebf3ddd7c21f2223324ff3ead68e34a799d2f2f21309a489abf4f59220880279cf77fba88322cb1d9ec6ef218c4febb6071695a7d809e4ea4e682913

  • SSDEEP

    3072:FrDq3Cj8LqEN9cy7jPLWCuHoq0lgmfaZXAR:1Dw/m09cyXYH/0lLQO

  Score

  10^/10

  agentteslaguloadercollectiondownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Blocklisted process makes network request

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2