Extracted

• • Target

    INVOICE PDF.vbs

  • Size

    55KB

  • MD5

    e017a9394fedd56c4a42d2dfe2b4d869

  • SHA1

    d05616bdaebb99b9666dd4748cb6ec65222db151

  • SHA256

    b27a2ffd8bfdfccbcc957473ac4492c13769913e2892bc41543e5b6bdf3aa2b8

  • SHA512

    64aa558244ffeee6e557493e616e3a8729fe41d04b1e177ec6a7c137d822d28cbbcf21efe469107c38a0258a331128d31637608ada971ffc7283bc53a55f929d

  • SSDEEP

    1536:9+8+aDJAkChjJsCujxLeiO927WSidDyE1Uituy4tfC95fSx1JFr5rshhf/nKI2Zq:I8+aDJAkChVsCujxLeT9eWSidDyE1UiN

  Score

  10^/10

  agentteslaguloaderdownloaderkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2