Extracted

• • Target
    PWS1-500KTL-EX-4M1 CONVERTER FOR GRID.vbs
  • Size 165KB
  • SHA256 e0516ae8e938052542c7e7a89713f02c0acf64a7ae9fe210ddbcd618d995e70b
  • MD5 36a8491cae11eeb576872e926b90abc5
  • SHA1 d0380b22ec8f20df70bf5c7290f9c062dd77e56d
  • SHA512 e0cf12a1c7643f4bcff61836214feafbf2e5982574662e4c9d845f644ab9794018ee92e82dd64886bba2351ca97c02a1faae6a76b177cee2859279ddc32cfb8a
  • SSDEEP 3072:sYC4yENVBkYr4LhpVXpKnupn8kH3DPbkhZi3eNR/7O7yedAHSdGguYe4DRZqN:s94yENVOY0NpVXpK68kH3DPbkhZi3eND
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2