Extracted

Extracted

• • Target

    2023798.vbs

  • Size

    198KB

  • MD5

    5f855f3655e8fd516ead68967889caa6

  • SHA1

    a54e6da34551349f7f063592a17a04a1aebd5fc0

  • SHA256

    6c28c18cb1792fcc9df2129febc69816800eb047b5a04e41e81b389bb26813d5

  • SHA512

    200f6c3a383d70b68a6c422889852f5b8b655d16fe62fbf5810ba45398510c5a436f6a13f01431b971d878f68ac49a8ae4b0b2f8ec52205094f74091737e7dd5

  • SSDEEP

    3072:6J7v7HrCV7v7t7T7Z7G7b7M7b7zYsrguvYnzUk8L8H6XJm3/ByGGGGGIGGGGGIG4:64xvmI

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2