Extracted

• • Target
    transferencia interbancaria (BBVA).tar.vbs
  • Size 1.0MB
  • SHA256 46376531988f10612187dd8c283c20022da0107bbc7a9964898f7e1dc31866f0
  • MD5 2560fce6723b594f3ac08456080dcc56
  • SHA1 1d62f6d8b45de19ee872e40a95c5f9d78c88bdcc
  • SHA512 f0e1c5ac9533505896460e38b7bfe4514385053c1f16948bf88c2ddbc4f4eb88eae32e65be9dd9a34c8125cf2d834fc6cbd5dfb15f3d11faf79533e69ed7fcb9
  • SSDEEP 96:7OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOp:2szBDx6Ksc1Rq69vUpOseSCW6Tq6N
  • TLSH
    T1BB3594124406063DDE2F95D268BB860611F5310B3FE1DF657F1B7B8AA0A4A3339F7968
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2