Extracted

Extracted

• • Target

    270028765f570ebbb238ee6fb9460d1a674707016d97fc988f772195516ad3ff.vbs

  • Size

    140KB

  • MD5

    cbcf626e71d764c178148e4637e333af

  • SHA1

    c3e2615fea0051e63e817c7ad9cc17b59d6da776

  • SHA256

    270028765f570ebbb238ee6fb9460d1a674707016d97fc988f772195516ad3ff

  • SHA512

    da100c32335caf638e6ccdb0ec37c6e0c6596dfc98b09ef7c39c20911ddadc4576adb67e58187a008be6183bf7cfe89646558bb9abed10374d9e9c5902111fb3

  • SSDEEP

    3072:ky7jgt5pEGwprytIsaK18meFZjcrsmiYADap1Ff:KRQjcQmiMp1Ff

  Score

  10^/10

  executionagenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2