Extracted

• • Target

    Justificante_134790.vbs

  • Size

    19KB

  • MD5

    9de837847e942e100339d463b5e83ea8

  • SHA1

    4a60fd23d3a15619b42755e0248805c66797fbed

  • SHA256

    41a67a39958b99af683c17ac26d30cdce693a10b96e4e95640230e22589ca592

  • SHA512

    ca7307aae1a71ad3ce08f5fd857b8df78139cdd9d990561fd05e9ee6108da3548fbb68a16a536abe1ccbdcd97318e030101fc0da176da6c6336a3aa28ed42297

  • SSDEEP

    384:66Q3GOmBsxCn0r7d8SfLnFW4mDAMnHiQBEiLwO9mvRwPzJ1:K39cs80r/RW4eHJBzwmm5W11

  Score

  10^/10

  agentteslaguloadercredential_accessdiscoverydownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2