Extracted

• • Target

    MT103_0311021014 PDF.exe

  • Size

    298KB

  • MD5

    b0d667aad13369585fb9399464927bde

  • SHA1

    c34036ae5e27f405d2ed874a65e2dc86852b65f1

  • SHA256

    bc31dc9da857aefa9d8865b8045b32e4af5a76f138c89f533c40ce1c662fd89d

  • SHA512

    3db2da5ef2c5a745ef00f0ce0e3243fac5623b80771641d574421cf9003a287f98fc2f2664c3f6a541a718d8ead1c779cedd6ec24ad57ac2611095be123f8919

  • SSDEEP

    6144:V1onEmMMMMMjMMMMMMMVW2S3LmcgAo0RJc54uoElKilHxN7/8RJ0tx2B:HodMMMMMjMMMMMMMV/S3LTgBMc54ZElK

  Score

  10^/10

  agentteslaguloadercollectiondownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2