Extracted

• • Target

    TRANSF.vbs

  • Size

    19KB

  • MD5

    0f800567f6a43b8ffd8e798bc9f6d0ef

  • SHA1

    cafb5d7641be2a7b09df950ca18d4fcdce3d86c9

  • SHA256

    4ac0cae97c31320f59c86ff1a49916abe51417f3e71efbb2794a619285d5c2c5

  • SHA512

    84ce5da3d8b4effd3ee79c483919396f2cb4084da39ca4e8f868bfcf71af7b243693bb7ee9c0b208bf9737ce5b82f3b2d613fdb29737b2bf0007319898267964

  • SSDEEP

    384:QQ3GOmBsxCn6EPbz4KGsucW3k82RhyUKYHTKGPQ5PEf8szkM8vtbn2DlXQBb:t39cs86EPbjSmlTKGQPu8ckjF2Rab

  Score

  10^/10

  agentteslaguloadercredential_accessdiscoverydownloaderexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2