Extracted

• • Target
    PS-PO0726-8406.vbs
  • Size 42KB
  • SHA256 e9855bdf3f45a2ed0148a1f6714f6ce081f4da526aeb044d2e58ee394e62078b
  • MD5 4cd3ddbea60eafc244b4fbfdbab25c91
  • SHA1 883d68eb68b0f62c8edb80e0984ea930676192bd
  • SHA512 634cafbb9c2d2cc68e7d32ab89fa86fc57caf8afdb6d8353af6b0037072f96cb04226f40a3ac3b47cf90cf8d922934b762666cb1c43339727ed8da1414dd9bfe
  • SSDEEP 768:LYGG6u+OqyRPDWhVVS2WLQIOZX8udKQ9RlWAVs+XLgVUkW5iYVMxpsti6hg4obYI:LYGGt1WTV/KOplTlFscbVMxOi6hsYMJF
  • TLSH
    T1EE134963DD350A55490B239EFC499A60C6B8850ACF2710E1FEE9E70D980AB9CE3FD51D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2