Extracted

• • Target

    DOCUMENTS.vbs

  • Size

    964KB

  • MD5

    c7faeee6a7bee0b9c88031c74961933f

  • SHA1

    c830717198c406f108040200cd687e0e9f25fda2

  • SHA256

    f7d3563d4e1017ed2f243d4fa74e737c4db433cb6b8a78dcafa7c5cb59c76c49

  • SHA512

    fbd44171445c00d2a7875d0436a11e691e061b6301ff6391e1eb2a609a89fe89f214bcf28f13c3695dd42cf9aa886910768c20e27db88773bd4129e3b74e5c08

  • SSDEEP

    24576:epGWy6Ik/RrxkoewTxrWKQvrYWE9WrwxFB4gW:mHPet1Em

  Score

  10^/10

  discoveryagentteslacredential_accesskeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2