Extracted

• • Target

    403347a566bd33798ee17e8b7d546dbe8ec4123a849bf3a9b3f948b72caf0a0a.vbe

  • Size

    14KB

  • MD5

    e5b0cb3019b7a60bd58fe2d18d75be4b

  • SHA1

    7a35bcb814b31bb3f2d089cac43d6e0db6373a6a

  • SHA256

    403347a566bd33798ee17e8b7d546dbe8ec4123a849bf3a9b3f948b72caf0a0a

  • SHA512

    a54ca5b82a7c430e42c9dadb91b56e03058027fdcc2e2e8f81569d24b0e6e0032005331a1ae064632f89797334e8afd03655b2491547e93925e703f15888af40

  • SSDEEP

    384:wCQ3GOmBsxCn5NbEDE2PlWdjSsTivPTknILvTY:q39cs85ctyjSsaPT/vc

  Score

  10^/10

  agentteslaguloaderdiscoverydownloaderexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2