Extracted

• • Target

    A08000143_ESP_B64891013_ESP_823041009945_20230405.exe

  • Size

    611KB

  • MD5

    8081970a212f3daf2249abb85384611c

  • SHA1

    a186e350b3cd30fbe157077aed389aba452185e3

  • SHA256

    c01119367072c1c37368da3c14e800e66f9e3f89d304612686ecad896af6daad

  • SHA512

    aa5250760b0c6cdc727306a8f28144307903ad94a7d23c9c99522ae93569bfafb2f120aa59aecd5dc920334291b3584ef5642d10732633c37276b1f00d342dea

  • SSDEEP

    12288:Uoqqqqqqqqqqqqqqqqqqqqq0qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqF:U12FGRxFukDzN

  Score

  10^/10

  agentteslaguloadercollectiondiscoverydownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2