Extracted

• • Target

    d14ef42bd2f3ecb7ff2e7ea8b7fd79b06f5b048c2f181381b5f8b790b7228f3b.vbs

  • Size

    5KB

  • MD5

    62bc79cdf5d55f891ae6d2a662cb87fc

  • SHA1

    2ab352feb12da98eca4c5ec9ce4b349f5731ab50

  • SHA256

    d14ef42bd2f3ecb7ff2e7ea8b7fd79b06f5b048c2f181381b5f8b790b7228f3b

  • SHA512

    1335d32fa999b5f3729f0b94caf214e09b78c9f3108c05e8fb6fddb828f7d8049a17c2e1b72ca12203ebdda0141d22c326e1986057677fdb9efe6970638c7db2

  • SSDEEP

    96:QsLisJvmYz2W6/F5J9eI8L7YMH8NJPW0agOVTLU5VFPB5Gv9rmJ/pCz6cfp:QJs7R6/F53IYG8NJu0aTV/cFaFrmxpCv

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2