Extracted

Extracted

• • Target

    bac9cf9d033c6cf330760aa17114afd84902f0c593edcc2d19ad50d98a33ff17.exe

  • Size

    195KB

  • MD5

    c82e3fdd2598580157f5e60f4d297534

  • SHA1

    c60961ba9759fd2c9273f98a4e7e7a6298b6ab06

  • SHA256

    bac9cf9d033c6cf330760aa17114afd84902f0c593edcc2d19ad50d98a33ff17

  • SHA512

    c06e983a83f8e8eada8dba53bfade4fb02d74c236423a122eb456e2b4736ab5baed248b59f9d388d1c5fd2af1c194f1256d2f56ea81cc33bb2b161cbb2e1d8f7

  • SSDEEP

    3072:kdnrsfnxxgUDbO4Vt4letKbkzIoPvVV1hfBgh6xcG/SkaCasi6lwKAUGGH3WkLa+:kdnrsfHjOYiUvF06FKkaYNeiX

  Score

  10^/10

  agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2