Extracted

• • Target

    9b1f1414bff408d0805aa754f99edd95685fdab208e9c79073af974dd3bd5cb9.vbs

  • Size

    298KB

  • MD5

    4b380b3495195336b422bf934986b8ec

  • SHA1

    f034367576a0b0310b59b846d5b90363d854f09f

  • SHA256

    9b1f1414bff408d0805aa754f99edd95685fdab208e9c79073af974dd3bd5cb9

  • SHA512

    45382dc25b6c4618c13803d0638100a67b22711d53a24acb3abb6de5fd17eb8eafc104a65881f93f286ef6f890b91a41ce06555ae2a40cea358983dd6ed04312

  • SSDEEP

    6144:A62XBT8TyTsTYTYTzTGTvTNTwTgTWTtTdTTTZTeTUTyT4TiTjT0T+TATpT/TlTsA:A62uw+G6sGy8ELL1F2U0

  Score

  10^/10

  executionagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2