Extracted

• • Target

    2023072401 DataMarch.vbs

  • Size

    166KB

  • MD5

    f4b9002a475115cb909549d539b624bd

  • SHA1

    936174112283c206af454063673e4a068328e85b

  • SHA256

    d5ff5e2daa191c35c06516f89b81bc682e7ac53bdfaea3ede48e84191532f375

  • SHA512

    0013db6fdc1d0d7b7614ca639eb0f698a6cce2687eb99bfa22536b6b6731ba5c942ba57209d18c33017f6ea9ea62bad7ccb43be5d1add018713ec2d12cd8ac69

  • SSDEEP

    3072:1pK6/PeadLaz+kxSzn9Lj7rZeqGbHfNcckB+HGuG5Elx7d5czQON8DyRQe2:1pKyPeadLaz+k0zn1j7rZeqGbHfNccku

  Score

  10^/10

  agentteslaguloaderdownloaderkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2