Extracted

• • Target

    RFQ 071.23 020.23.exe

  • Size

    672KB

  • MD5

    482763510b94fcba0f140baf71913c52

  • SHA1

    0b80a3603e6a919232fb2ef003e56baa15f52f75

  • SHA256

    536a5d0e0a0283a2037d9a01efaf92c4e119647ad3b8aa4d644461de984399f8

  • SHA512

    c0a81e3898082ca3e416162b6a4a17779f16479025af51702c3e7c158a16cc24f9f9d7cbcce10e3b51d214e5f3297be2586d78284ba02d37800578018501f181

  • SSDEEP

    12288:vMw4EAPcLqbFLPc3eBxnt8pxlZT3yZrn0aHDyq9DSXALFW+JGcaLUn:vMwtAPcLqbFPseBxyB3yBDyq0GlBn

  Score

  10^/10

  agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2