Extracted

• • Target

    46a58ae7fa97e17a30c6031d4777fd9afd0a64385b131abd18750310a8223ed1.vbs

  • Size

    10KB

  • MD5

    e15e52fcb81395733818343b8ece6377

  • SHA1

    e595c6f83b63de54e8a62b38ce51b6e75e40d14a

  • SHA256

    46a58ae7fa97e17a30c6031d4777fd9afd0a64385b131abd18750310a8223ed1

  • SHA512

    eaee0355a05ecbdbdca3e2c17a47aebc987b4e03c2ea44cb8e4f56b67a70e3ecd080b26d10ecde01e3fe626fa42114b3d5ba39fa63b44d25ec48c9ed0f9ed973

  • SSDEEP

    192:30BhclM+TvETdQ+aTXtMFEOcKT1cW7C2EV+qNBNQh4b+:k7cPTvETdCUu81cQkN/BK

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2