Extracted

Extracted

• • Target

    1d904923afd1492b273adde94f1f53bb7f013fc66dda235714fe579316efa556.vbs

  • Size

    22KB

  • MD5

    bbf3e640e78ef04169cea2d4fdc8b99a

  • SHA1

    0b989fe0ec4d245967375891f401e6eaad551a23

  • SHA256

    1d904923afd1492b273adde94f1f53bb7f013fc66dda235714fe579316efa556

  • SHA512

    bed6cd983b87a20816ed12b5968fb30590f9907cda5ff9e9d8a17ba65fe9254a9203dcce6d172ce62bb2b44e6d75769535cc955e4df29875f583eacfd4e876d4

  • SSDEEP

    384:KScT5cOUi2ZnbxPatJfRRI/DozpsMfdOpNLQ/JD31z3jVOcmjrKWALvW:KSc1fUZZnb5aHRRILod0NLQ/JD13jQh1

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2