Extracted

• • Target

    Articoli richiesti.vbs

  • Size

    53KB

  • MD5

    68a4d5e4c541961d428996136e9739aa

  • SHA1

    ac722c0b712636eb7efbd995035dd149311e0ee9

  • SHA256

    0dadaf0eb1832bfa87259ffa7481ab5cfdd40455dd6643858f856afceaf17c14

  • SHA512

    379d322247d03e9826ff4bc0de5a849da314f8631b59f0ccf36949e98999f11b84ad564f84e7497755eb333aa0c82381e844a16f6fc533fcec86ddb710e6d517

  • SSDEEP

    1536:Y7ApYVwpqGY8n/pevDkFwjYkRaSQSAykbhATO4RWKIRJRa:Y7ApYVIsvDkajJUSaxF4Rj2fa

  Score

  10^/10

  agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Blocklisted process makes network request

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2