Extracted

• • Target

    PONO6188.vbs

  • Size

    59KB

  • MD5

    3c00879a0e4e4a7d7b78bb8611bcc94f

  • SHA1

    3ddd2f54b7fb54df60134318515fd61b119bc46f

  • SHA256

    94ffc7bec0cef06550d739bc5014a3232c9218a50524de0464b53b6dbbd7ed5f

  • SHA512

    4dfce826cf9f7456dd981b4a1b4c985d75c9c849434a94c5987bd08fe037217b5160441e23072c498b5e9c93e2d00d8c6e814ea1736e68724aa461881ab1b31c

  • SSDEEP

    1536:cdukLI1gPDPTxyk0MfFCNqnlAEfen8TCQr:Yukk1gPDJzoGaEWn8Tv

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2