Extracted

• • Target
    GRAINS.vbs
  • Size 2.2MB
  • SHA256 929fbee164997ce91edddfa6eae72cad7afd11955480d2582bfdc964505ccea2
  • MD5 4bb2f623b8e05072ed01e7fd0e9a4e28
  • SHA1 b53851e2fb8d9da46d05c813da5612a04e72242f
  • SHA512 b2740378d3d52935e8b3e52a6c4c74928de678dbf449a08796e2467cef341b03fe755132b4aaf4fa4a63428854a42749584acf779efce4340ab9c22cfca1e607
  • SSDEEP 49152:B20hVNq/RiQ4N+jRDSBTUxaWA/ZUgHYuhEBprt6:P+U
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2