Extracted

Extracted

• • Target

    Shipping Docs_waybill NO 2005xxx351.wsf

  • Size

    189KB

  • MD5

    3b970c76dbc74cd9b119f487a22c1683

  • SHA1

    4ebb9876723c2fc5fda46b098094cf0104efac55

  • SHA256

    73b63a59ea3c5c6f049420fb7a4a4dc4e91036c24e2b25bae406aac1f56a1812

  • SHA512

    74f4bbe6c8ff3769e4a70189bf28aba7ac0bf8c6a4440c88b24fa6d2207ea4169f032b37d465ca981f2bc4f69f25fd089256bde24d88f7a4e003f6d80beef821

  • SSDEEP

    3072:z/zQ6Vv//riU/tEqZjCwNZiU/tEyWiU/tEqZjCwNZiU/tEAI6:0U/tESLNQU/tEylU/tESLNQU/tEa

  Score

  10^/10

  discoveryexecutionagentteslacollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2