Extracted

• • Target

    3a268c683729ba9c5975d4f8e63bb6cfe984cb6b66f5339b22ebf03743cc6d05

  • Size

    668KB

  • MD5

    8e0d4e580ae0361aef902eb9f2e952ff

  • SHA1

    20ab04747e22eb1ff6cb8956cebf2f1876add6f1

  • SHA256

    3a268c683729ba9c5975d4f8e63bb6cfe984cb6b66f5339b22ebf03743cc6d05

  • SHA512

    84caa76bc127159aa4a5caf807ebd8a85e62c1ca117dbd5c28bb17e6e76c2b426298dd091d4c5503dbace3a41d8c57bcef4bc9d71773832abf71ae7ddb6c2351

  • SSDEEP

    12288:s1CSfMlEPbEQwDLniL98GcVkTxFy/zTvfCVcyo/s52eACTT:ofMlEPbEQMLkZoiVX

  Score

  10^/10

  agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2