Extracted

Extracted

• • Target

    Texas_Tool_Purchase_Order#T18834-1.vbs

  • Size

    8KB

  • MD5

    85bb05a80334099ded83e21dd686c567

  • SHA1

    308f10b6208abf4a9c92736c80b6dcb01ca332d2

  • SHA256

    46d29ed35c7ca72d44d99f3d12603cd11435b6388bf61cd9988e7d375ddbb7b5

  • SHA512

    b70ebc02b5bd572762514c6fc51c667a60f2430ddf0715f6424286f15402c5deea08a45c5df6ca1deee391d13c71da115cdc30907e63b8caee6913de151031a7

  • SSDEEP

    192:jhNB4p8EjRXbRKclRi7uhzT9hNEIjgXmHpApCmJGPD86UfxbiX6j6OD1p:jmp8WRXbRKci7ux9wIjixpCKGb86U5bV

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2