Extracted

• • Target

    MY00046R0239528MYKUL.exe

  • Size

    154KB

  • MD5

    da9e335cd673f6fe0bba1fa82aa04e4c

  • SHA1

    fdb8e13542a61d2e186e9b4b1cf1573868a80121

  • SHA256

    b2280e958e4020f76a0096cff05b795311599a6e36bdc9f3131e66bcfd27fa5a

  • SHA512

    e52fc95374f9b2ba1eeeac2ed82a406ada102db7fa7b388e2a18391c9a6c2fdb869dbf3f4eaa3fe3e84c0551721565da3174c85873a0be779a2acd36acdf4770

  • SSDEEP

    3072:cYu/YbAcxltXuX4bBGCOVy04vEfS7ylxJdEOA1Uz04/GlqwTNqjnN+5:c6bAcJZxC4vvGDtA6Yfg4NqjnNQ

  Score

  10^/10

  agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1