Extracted

• • Target

    6fe77172dbce4d78e999a1bc82050831700ec79f845ea72d75c9553fc59018c0.vbe

  • Size

    11KB

  • MD5

    0c5d6577dcfd6c4c66ede19648596367

  • SHA1

    7249beb634652ce5d28e2cde8dcf5f2b70e8efa7

  • SHA256

    6fe77172dbce4d78e999a1bc82050831700ec79f845ea72d75c9553fc59018c0

  • SHA512

    4ada397cee7c2cdd6da919036877de9fd682ac88cf848cb708e9b043866bf0b1ef7bc5b82cda836a7fb015e8891efb55f922d60f3ad89fcf245464a007ee0125

  • SSDEEP

    192:d81IYjLXBasxp+Srh/vA0XsBDBvbpXfprmufjqd/jznUc7gOVdvsvzeNlek5MCW3:+1IYjLXHxp19/5WFvbBprmuLqdLzxJVE

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2