Extracted

Extracted

• • Target
    yhkld.vbs
  • Size 375KB
  • SHA256 fa43e204762689b5d9a4f72bd2a6772f8d8436e02ddd0c6da9a0a26d475412da
  • MD5 32d87b2f68ef1dd11316fbb33f1f8597
  • SHA1 c23f436e333d31ef93f94949cf6d71d5d2d14458
  • SHA512 c84ff372a6350a37141be905db7c75d5efe6e229b83c13101997bfb73804863828904f0517731dfdc9ee4e233bd83cc25c3b05819d9ba178711c9f6edc2be0f8
  • SSDEEP 3072:EQaiUCrZUKCs7xlu4vrSCqtI4xvgGrk+KH:EQaiUc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2