Extracted

• • Target

    DH-087481 IMG.vbe

  • Size

    81KB

  • MD5

    b0e1835d06d4ae28eb1e1cee627360ea

  • SHA1

    31c82a2038f281fcc43377706d00c79c1d07bcee

  • SHA256

    34f4d416f700e77ef730f4ee4207218e7a3f978fc40efd8b7a399d58113d26b5

  • SHA512

    506479a1dd46f52000a175b779c1882610e432bfa4341ce0e4eaca975b9cc7f1ae45618bd68cfe934484e2347c2f9cb070c6e8b0c01938134a7fa7047a1c23df

  • SSDEEP

    1536:vZL/8DxkbzqcfC+bxucaTm1oF65imB6WgF8/SEcLuwI4u7293H:Br8DxMzpf5xuha1oFuiG6hyKJpI4uy93

  Score

  10^/10

  agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2