Extracted

• • Target

    4af7a6a64c88b2b820f1d3481e7a6e16bd26bd22abd4c9bbe521564378c13150

  • Size

    457KB

  • MD5

    85d4938850ebbcaac0e71855adb522ca

  • SHA1

    d13a6a5fa914a591d03097a5b19516de66ca3a24

  • SHA256

    4af7a6a64c88b2b820f1d3481e7a6e16bd26bd22abd4c9bbe521564378c13150

  • SHA512

    b1a63e79b152535936fc6f2f35a5e38944ee783b6acaeb3e90a8872d6cd01e977c464f04947b9df6b471fadc2ce9c276d3a9c3afd0112c5e3d61db381a2e1bb9

  • SSDEEP

    12288:AIFEzDgNxvJtKvJ5RZu86xkfWgKF+MRy+:VEzDgNxvnkR/W

  Score

  10^/10

  agentteslaguloadercollectiondiscoverydownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2