Extracted

• • Target

    ORDER FRANCAP.vbs

  • Size

    19KB

  • MD5

    eba1187e17a501a2f3d094a4250d3f8d

  • SHA1

    b4464bd1ee76a5193d3968ab655923b6489dd330

  • SHA256

    b03739cf9980db3787fffa12278cf821bebade2d5a30f84fb6d539cbc9d38bae

  • SHA512

    de75e7cea75ef546580cfe75e38ac09977d68a5f96427b109a56b612f46da537ac7b6ae379f9dfb073a50815ae553a52bf6c1ad323aefbb0b82c40a550b221d5

  • SSDEEP

    384:sQ3GOmBsxCn5h5adn877H6xfpG5a6nfJYhZedNMWn2ck2S5p:Z39cs85h5knImnsa6nRY4tQp

  Score

  10^/10

  agentteslaguloadercredential_accessdiscoverydownloaderexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2