Overview

overview

10

Static

static

1

inquiry#22056.vbe

windows7-x64

8

inquiry#22056.vbe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    inquiry#22056.vbe

  • Size

    13KB

  • Sample

    240912-pbkvqsvakh

  • MD5

    6560447c600eed33cb28e9d21f1c9c14

  • SHA1

    b1b1a13aa8034140493c6fe64b4961747e02daa5

  • SHA256

    619dc41d3f7ae8bb6d21d7b74f546848368a9b21daffd22464a48c3e887a560e

  • SHA512

    4e690493807437b8d0cfe7c6e216108492e50d9b96c867d540b30fad0446809db3f503e9388312b8ab1147f2e6bd713fd29630ba6963cd891e34ed2a96fdd1f7

  • SSDEEP

    192:bPJ5uz3LBGJzp5PGTzASKFCM1w938tB4E6rAYxNvbEWJ/G4ciT5e/r18vDmFTHyK:DODcTxYzAf80edtP/jZFer18ATX

Score
10/10
agentteslaremcoskeyloggerratspywarestealertrojan

Malware Config

Targets

    • Target

      inquiry#22056.vbe

    • Size

      13KB

    • MD5

      6560447c600eed33cb28e9d21f1c9c14

    • SHA1

      b1b1a13aa8034140493c6fe64b4961747e02daa5

    • SHA256

      619dc41d3f7ae8bb6d21d7b74f546848368a9b21daffd22464a48c3e887a560e

    • SHA512

      4e690493807437b8d0cfe7c6e216108492e50d9b96c867d540b30fad0446809db3f503e9388312b8ab1147f2e6bd713fd29630ba6963cd891e34ed2a96fdd1f7

    • SSDEEP

      192:bPJ5uz3LBGJzp5PGTzASKFCM1w938tB4E6rAYxNvbEWJ/G4ciT5e/r18vDmFTHyK:DODcTxYzAf80edtP/jZFer18ATX

    Score
    10/10
    agentteslaremcoskeyloggerratspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks