Extracted

Extracted

Extracted

• • Target
    618b33a72f9144d36da3ed9e1b84069bf996821512d8ab30297da3bea81633c5.vbs
  • Size 2.0MB
  • SHA256 618b33a72f9144d36da3ed9e1b84069bf996821512d8ab30297da3bea81633c5
  • MD5 5fd1872cf90c4f2ff94fae2006f4340f
  • SHA1 11f1b479a30ae24350258a8e63f2d5a337a3b00f
  • SHA512 87723b1e51d92950eb740eb4bafd04b35ffc870ef4cb460ab3b4a806acd29f57bb188027820ad26eefb568a8c7d426f16d5d184e804cacca97b5eb104b34fb2b
  • SSDEEP 384:WODvx8wAkgmfWqSxvmdcwI2IfXherzYIbUsY4sEzfXtx65ziF/r2e+2NpbQ7RAe:9vx8wApmJm8l/fdx65ziF/r7NQqe
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaxwormkeyloggerpersistenceratspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Detect packed .NET executables. Mostly AgentTeslaV4.

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables referencing Windows vault credential objects. Observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables referencing many file transfer clients. Observed in information stealers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2