Extracted

• • Target
    Comprobante de pago.wsf
  • Size 432KB
  • SHA256 e74ab444591fded2b8ed58550a089913d2faccc628745b86f70901dea8b4d0f6
  • MD5 93c49fba767285eb8823109004319aa8
  • SHA1 f9887715b750d287db9eb4660f3565aa4e23f9dc
  • SHA512 3e1ee66db65ff96cabfb3dd015ff4094c790fec87b4d86baf4d84dcb8184ce7ecb5b3fa49d6b5a6123a5509346355da0f2e56557d9916dac1d199a642f4fd077
  • SSDEEP 6144:swK0ZJrDUxaiJNkqHXhnRznP+pK4DIK6IMNtSrZis2o8Mmh+xT:O2DUxpJdzaK4EDIAta
  • TLSH
    T1C094734523C4EC9447CB5B3B3B2BB5DAF86A0CDC76548849F244FC91F4A8706E9D2A39
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2