Extracted

• • Target

    06b041ee542d3bfb8cf715ae24ddcf90690eb10bd907e720def9b95fcd2863bf

  • Size

    23KB

  • MD5

    ab103943971ec70f85355a29e31dee3b

  • SHA1

    4c5508c99ce231f48d0be8b8cee943c4259316e0

  • SHA256

    06b041ee542d3bfb8cf715ae24ddcf90690eb10bd907e720def9b95fcd2863bf

  • SHA512

    79e4d40098fde5fe467d1b84dae7243ba1402de4f1455489b042f43210fa7b97643bc97c4e1a8dc4bc16ef96a5d11e12b181ad753db8e8c624382e87f142a693

  • SSDEEP

    384:tDH9PoHrFUqTfYY/G6pNXI+icmCf1YoM5IZJu27PIZAKZFdDFbo2FEIqoHJDEwX:tD6HBtTfYY/icmCf1YoM27PVK/bwoHy+

  Score

  10^/10

  agentteslaguloadercollectiondownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Blocklisted process makes network request

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2