Extracted

• • Target

    929fbee164997ce91edddfa6eae72cad7afd11955480d2582bfdc964505ccea2.vbs

  • Size

    2.2MB

  • MD5

    4bb2f623b8e05072ed01e7fd0e9a4e28

  • SHA1

    b53851e2fb8d9da46d05c813da5612a04e72242f

  • SHA256

    929fbee164997ce91edddfa6eae72cad7afd11955480d2582bfdc964505ccea2

  • SHA512

    b2740378d3d52935e8b3e52a6c4c74928de678dbf449a08796e2467cef341b03fe755132b4aaf4fa4a63428854a42749584acf779efce4340ab9c22cfca1e607

  • SSDEEP

    49152:B20hVNq/RiQ4N+jRDSBTUxaWA/ZUgHYuhEBprt6:P+U

  Score

  10^/10

  discoveryagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2