Extracted

• • Target

    Justificante_1305.vbs

  • Size

    19KB

  • MD5

    9b1f7ea12daa77c87447f05ff1ac6f5e

  • SHA1

    58d9c2cb1c146a81412a308d1c6b6b8b6e31f1a4

  • SHA256

    2e98277dc23d49726e32785822944fd82ad43068321e1b5ee7e5d1d8a8bc1bbc

  • SHA512

    035a86675229744b63b5f0974164e12e6934a35074f59986b232bf4c6acda245bca34982b8c649ac934659e6af0e8e33ed7b049c58bda787ba9277956c06114b

  • SSDEEP

    384:pQ3GOmBsxCnn+8jZHMfOOoq76ITBJQcO5I4xDIeiAD2F7sGk:639cs8n+0ej2OBJQczIT1

  Score

  10^/10

  agentteslaguloadercredential_accessdiscoverydownloaderkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2