Extracted

• • Target
    comprobante-swift-897785587645.wsf
  • Size 58KB
  • SHA256 cd9cd7e99fa61d55eb95b7b9fef01cb2c53404bd76ece24858d5dcbc841fc59a
  • MD5 baf24a1c452acbc25fa2e4e7cfa8af7d
  • SHA1 552acc0037f8b8865287ed5fa5557292fb44b65a
  • SHA512 80b97c0011b1c7d8dcc505025406d29f1707b46de159a337e2f60a2402330be1920c5ab6a3a79fa75e72c8c7f0fa79bb8d58c09f3eeb8da84d1b2c8c27cd2289
  • SSDEEP 768:JHLR3cm1QEcnuG+q03s8pLa/lS8nIiX8rMOOeulWS/dlbkYLNmONeWMgTDzi5S3D:BxGE7GqseQ8CxRDJBmOWQziw3ui9yl4
  • TLSH
    T18043A7CA3AC1F0A4C661B0B76E16F195F5698C80B28C4094FFA6B05DFEB8704D5B96F4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojanadwarepersistenceransomware

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2