Extracted

• • Target

    Resim Yeni sipariş ürünü.vbe

  • Size

    46KB

  • MD5

    22846467cbbc1f9d400b2eb884f28a33

  • SHA1

    e1b255b08da7a762f207b9d08888850ea1edbbf7

  • SHA256

    0e526316c7124c5500013603c1289438aadd4176ab13a7624008cf4a876523d8

  • SHA512

    6f5771054c0a6a0ed2a66363b44699a200ad7408087e523bf8fef47b7b6b5be9c9f33e67f0a9ad76cc1076b0d4e18c30c8c2f0433f3cd66afaf42017a958afdd

  • SSDEEP

    768:hfM4lVxHhH+XQhnpFALZQ82skDotv6EnMuAfn8iUd5SK:5MgVxF+apFASs9vznDlzSK

  Score

  10^/10

  agentteslaguloadercollectiondownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Blocklisted process makes network request

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2