Extracted

Extracted

• • Target
    vbv6htplztg.hta
  • Size 30KB
  • SHA256 5a43e67720eb299fccc8a096a20ab298009e37fc6febe048b617c5017347da86
  • MD5 001975cb157cbc8b5e05f43846d790d8
  • SHA1 54fd821f38d51dd906fab883e8c357093f5fb7d9
  • SHA512 fba1c202b3dfbf9144255e99b55f3bbcf75ca778ec0bf7c1b2155a173aa372c5c429ceeca077b9bdc129b04f647fb1eb5d1e912727316d8623f29b153f404df5
  • SSDEEP 192:FpkN1WuQOdksr9kpdrEr+iNAr6cvvUrA+iNkrakdudnAr6ZWuQOdksreirE6kndC:FvG+dH
  • TLSH
    T112D2D9EA2CD9C951CBE8322DE4EE0728F0BDB2C2A9564DE47D1D12458BD608F49E1DC6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2