Extracted

Extracted

• • Target
    mondyyyy.vbs
  • Size 420KB
  • SHA256 b5c28d591dee22fc0e4c729d2d6fa990e1c0c09acf9dfcc2ad20db3e0fb2e6df
  • MD5 2a269f11b6fbfe69ebfce26adf8b12de
  • SHA1 a947f8eb752681d3807a12255e029b293657d539
  • SHA512 6733eb711b360b47d26ac4cb3b8ebf91391c3ca52f957dc3eca880efb493fd4254912d7fb96ac64228c52c662513ddd955de604c71bc4882907df9b2014583a8
  • SSDEEP 96:wrM+Akk27tUYRq6s6XRdFa2bQqjQnf+D7r:wrM+Akk27tUYRqf6XDFa2bQqjwf+D7r
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla payload

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2