Extracted

• • Target

    Tissetrngde.vbs

  • Size

    34KB

  • MD5

    9fe478e933114de5b38c308c2bec8b13

  • SHA1

    3f2852e29db20b3128f2bc774fd742e9490e377a

  • SHA256

    8d13a54fec0e9490fec161a7944c0f5af2456030946c86965b30c58e54a987ff

  • SHA512

    1ff08c050da5d7d02aa07b728c0e3e409772ec3957a3c3b3c6b12d0a1a700688f77a24481209b411051037027b97730857ebe8ef25d133dc8211522585891823

  • SSDEEP

    384:/E/p5dFHavFy70k+Qa/xyIzH8qBLGNZ/y3i/x1yfGAzHaItMdIGg:s/pRyRQ0RTBL8XJ16GAzHTWjg

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2