Extracted

Extracted

• • Target
    Quotation.vbs
  • Size 1.9MB
  • SHA256 63960c6aa8b507e137fa4c7ce26709505747682003bb54de4236f8a14dd65886
  • MD5 d6db69726f17ffe7ea9fb7e3b021274b
  • SHA1 30af131c34707abc20ee5fad6402a08737c899ce
  • SHA512 503f0337d86ad09363332c4ac0615d66cebb8e6add0c3808d43bb02f0e1191e9745a3a7f49ce4e6e516c4af260040943e0baa59f07ffb7405ea266c931e4eb22
  • SSDEEP 768:Me5PDaOYn5TtGXMd6Ih10h4Ehfiuqu/C3C93m3E31:/
  • TLSH
    T1D6950872DE450766606F8EC279386DA24AC43433907582BBB7FC8CEB6C5B08D817657E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2