Extracted

Extracted

• • Target

    Image_001.vbs

  • Size

    507KB

  • MD5

    369b2913abd7a1e2ecfeea185e737e61

  • SHA1

    eb9431fc12b373c216e2c89af2cfdafdc5dae727

  • SHA256

    8264386f0b6a0e9b2aa5f908dc3909f4b8a61b619edb269baf56bf7112ae100e

  • SHA512

    e6e02f36641a087c1e437885c1b432e325f6b805ba371093302092912065515efe090121ea54f432ea6e23c466a44635c426efbaad2268cf03c251b0657f8f9b

  • SSDEEP

    12288:bsD8YhlqjFf0pIWLNvd5/iaPr4/Is0en9sAWxihGmxLyKSHPh72RwsZIohgrVVMA:jcj6whXoTMA0t

  Score

  10^/10

  executionagentteslacredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2