Extracted

• • Target
    HT0-3673.vbs
  • Size 17KB
  • SHA256 3c6fd17b9f959fcb6cc932f5b9219588da2cb055eb38c35d6bf23c9a742df655
  • MD5 9592062ae5d90935fd1a419e6c440070
  • SHA1 f64143793e2a31b6feed98f3d5b5f73f8d381041
  • SHA512 05d64f45cccb5bff0ef53ae81d597427bb53da1b2ac7b40946cdb1c61d21f79a530f25c4694b8fa576532cdc4b3f55a491c75eb88bcf594767cbf7c41df85e8c
  • SSDEEP 384:KR8ZiOBWXt4wnk3riwNf/CBTY34hNgkJrr+IDkwlCIMB7dH:KR8ZikMGBIu3WBrHcbH
  • TLSH
    T17482A519C905DBF40A3D32A0A66B6816A91003A3B5393D8D7D8FC19D3F7A660CBE54ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2