Extracted

• • Target
    Consulta de compra NPI202604007.vbs
  • Size 2.8MB
  • SHA256 04479c87f9174eec4aea4c9c8d8ca63ff1b8c0845918a1ed6bac784d2f405209
  • MD5 52847b3ade5bf05016c79c6c75059ac3
  • SHA1 2c5e88c59279ae2e43b101a41e8d53f2bf269924
  • SHA512 36a0ab54dc23cb0e27b1de10fcf9a403be47ed95e14bf005c08dcea6397a8303c5d3d42e4a32ea9664f425a4a1f002a1db8ffa5f2a899ca816f3073b1f18abb7
  • SSDEEP 1536:VER8YU1gEi3YNVWwR3HOPRsgwvRhZ/Q5QEhgmmaN6xQ8m8Wvu/sO2ydvoRsgwvRL:V9
  • TLSH
    T117D5F303E16274A6C1452100A1F8DF00E50DDD2865B93BFE7EB9CDF0734997BA89EEA5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2