Extracted

Extracted

• • Target

    RFQ20240326_Lista comercial_pdf.vbs

  • Size

    37KB

  • MD5

    80c96ad14b599fbc36f688a6dbc2efb8

  • SHA1

    031ceb90f111733e78a69f883d0d8465db7712d1

  • SHA256

    0b8154e3905fe82a62732791895e0510c240067b97f5ddf4edee2b10f2e984ad

  • SHA512

    47d1b5a2046a7729717f22c0b2dfda92bbea8360570df3d19c2882955a0ec312d2aa46cc6d2ef6620979bf97d1ce67484870c77994fd835007f273cbcc4cb5a5

  • SSDEEP

    768:u00gBRvWAZGc8NnKwiQm96aPESr2bBiort:X1qNnKwfZSibBi6

  Score

  10^/10

  agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2