Extracted

Extracted

• • Target

    MÁY LASER SOL E&C_FIBER_20240515.vbs

  • Size

    428KB

  • MD5

    63c9e6885ce22fe4f260b7415e8dcd57

  • SHA1

    d469f256e344841ed4fb2cd5f977ebecba23d397

  • SHA256

    27438e31d5f47cd00c0f95379ba8516a439efb1291386d26742720e4d5dabe39

  • SHA512

    12accf888566b98277c095e830cb21d7cc11be582036da57a17437da43e32d9158f399acc5e3cea9679fc0655a3b5ac8d0a8a8e947988b9776c0d965f4a6dfc3

  • SSDEEP

    6144:0y4t1fXGwzkAitPzmeI9OQYypkHkSVdtxQ+5iYgbAL0WMhw19+z0yhtHn9eq/+4K:0VJv0ayfOb64MRycngoavbN0vBrbNt7

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2