Extracted

• • Target

    FLUKE 810 vibration Tester.vbs

  • Size

    39KB

  • MD5

    1bef7f8d8e8c56eb3c97145c73ca9349

  • SHA1

    ebe18932bafb53f5625025d9a2d0425d1bd94b19

  • SHA256

    80d595f9e8002169ae694344137740dced889fd34b08f1b8ace34208957c7799

  • SHA512

    910aea33d6faadaeca883774dc4e360ec90cdddbce1859d4bbd86ba3f6c1e5a94094eb86fae5588d7be952066ec5580a32ce3376614b5172602c34b41688f41a

  • SSDEEP

    384:u05gBZSUIWz0AujGKoCJmMuttrW6ku83V3aiHwhnXH/QSj+jhDzYUHyOKGrzTCq:u05gBZAWAZGc8NnKwiQhnkjhoUSOKkT

  Score

  10^/10

  agentteslaguloaderdownloaderkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2