Extracted

• • Target

    111.vbe

  • Size

    11KB

  • MD5

    f4f90d06813ebae0cf591acfc33a9b72

  • SHA1

    4f9563282b62e08ac9e31856c8394ffa474f6c15

  • SHA256

    5e8f82fa0592f63a811dea02c5875cc502ff322bbdf855de1b71e2399ec8f029

  • SHA512

    42b643ead7537c5a7ef63fde8eed3d75211cd0f39bdcefd79afd0345f00c2627f0a6f8120a1c1be1c947ed0e1c0ee8970d688221ff9f40572d3c6806b7b806b5

  • SSDEEP

    192:kVPCg3XXH2AYKtbXq1qFqpSJ7sWfqH2hmDaOdC8NhuOzWNEK:cH3XXH2aA1qFkiQWfq2mDLdCpxF

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2