Extracted

• • Target

    Justificante_13087.vbe

  • Size

    15KB

  • MD5

    59743d96ff1e3796e18c6114bccadcf4

  • SHA1

    524a31d5c9d8f25148024aae2cc1e28a8d83a1da

  • SHA256

    ee2dea0f5362f6a3410bc8c9f199c740aee91971498aa77ffaf7eb546da7c957

  • SHA512

    916ad151f03a72e105c5f2afcdf3ae1ef952d37b069045c2418c050a5d79907ac1e4d32c4b0b0f9ce1d6a0f0d99477fdc8a77b89e717ca7f270919051c3d617f

  • SSDEEP

    384:QMVQ3GOmBsxCns4avBwx9ZzEC4FGJujI+PH:K39cs8sQnQC4Tjhf

  Score

  10^/10

  agentteslaguloaderdiscoverydownloaderexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2