Extracted

• • Target
    PYT W2471234-MLIG.vbs
  • Size 26KB
  • SHA256 d1f2b9d526e525c0606a0e51ffbab653385f39cfe51a72db6c4aae7e980e49ab
  • MD5 39a85902c2ada159af5d936ca50c41ac
  • SHA1 36d11e5c3cc68c2cd52e3ac6f58c8335d23943f8
  • SHA512 535507050cec1e85210f73b4e080910d190b65ceab030726aa22cf9846bf010cfcf0fce1a2619abb6ab6f2767f6c2808afaefffe81ce0765cfa67dddfd78a53e
  • SSDEEP 384:poUk2uAnLbnpY9nu2k0sfVd1zXTal1Tasj80sRoj9SXpPwh:pU2tydk0sdd1T640JEah
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2