Extracted

Extracted

• • Target

    order nr. 0123 for 1.000.vbe

  • Size

    28KB

  • MD5

    592f0484a76de4f5edd8f9bd9d48e6c8

  • SHA1

    8b72670572d4a1be6ae92ec5dbd3eec658e0ed66

  • SHA256

    dfb92d282ba5ff519b2439265d3c9257bc23d7eceb05fc969eada0060cb23380

  • SHA512

    47621868e8fb52cc671d819a3d7941ba39975ddd8dd92b3e2efc51b7653ece679c97d59195523919b3a661b82c83ef0a572f17b68ad7e4dbda5626ec75798874

  • SSDEEP

    768:GAmGerlP5Z/JlYRhCn+CHdR0NnKem5y+QwJMOHR:HmGehPXxuRGdm/msTwJMOx

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2