Extracted

Extracted

• • Target

    PagoFactu.vbs

  • Size

    124KB

  • MD5

    a911fcb381e94db6603ee3bbed255241

  • SHA1

    e388706d286fca439dae5d0e59c446260e29e47e

  • SHA256

    1ef04afb88292cc59711d31f29175aa4ee66f0fb5431c417ad4f02cf3588d935

  • SHA512

    d7112dd62e70c0cabe505aa834d37be53e46e152ca6c06ec9d4314412262fe528d16e6e0d285b29e4acc1ae10d58798567f4bb88a6c747ca65541e575e43eab8

  • SSDEEP

    3072:FXFq3Cj8LqP/D9+y7jP0WCuH4q07guhoK:lFw/mPL9+yXFHv07N

  Score

  10^/10

  agentteslaguloadercollectiondownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Blocklisted process makes network request

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2