Extracted

Extracted

• • Target

    Cotización.vbs

  • Size

    318KB

  • MD5

    af07804be156bc522ae4a2f0dbd04ffe

  • SHA1

    d4c1df8310836d4dc62fef06462f024496a5448c

  • SHA256

    a0eee785ad7362d359cc120ee9ec1455fac3e713a5f7912eee64c163e2223a48

  • SHA512

    a5e7be4b3f5040f737a68a9801a3962962515a4909bed4ba33d546632f15d6f948905ecb13b4c007a300e3d46db2a471db6d3e3c2b86e6f42d7b84a58b7a5455

  • SSDEEP

    192:xqK5c6S0jjuQjjarGkEudzptZEygbKjreYSikjjjjZutYzK1pGt6ZZZSpqxagSTU:xqK5QNp3ngqxXSYZ2Ur

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2