Extracted

• • Target

    ca4d0af48b50bd06f172eee41fb979e2d73defb5c51fd358bc6b36de4cab7369.vbe

  • Size

    10KB

  • MD5

    90d3ad68895627841ba7ac18079fc0b1

  • SHA1

    a00920b635b500f67983ab4bed25a38df9bd5549

  • SHA256

    ca4d0af48b50bd06f172eee41fb979e2d73defb5c51fd358bc6b36de4cab7369

  • SHA512

    8e3d459a1d11cadfc336c364918c97ecf0004418afb890bd3b36e9139d30bfe956266f2e87e29e2e5df46b01e94c1bc64b9964b3a556ad64f6a5b2a8afb493b6

  • SSDEEP

    192:xXNM3lLrcABBqcDsPdSuXZlzrZ7gmUWoZl5FYleLMl/1uw5YOAxJhHFK:xNElLAAKjBLf1UWobElwMl/mHHs

  Score

  10^/10

  agentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2