Extracted

• • Target
    Quotation __ CHFR 0048294727_USD.vbs
  • Size 589KB
  • SHA256 1c03536c16062fea96eb021569fe7755cb24415937f0f44f05b4abdc7b53abd9
  • MD5 fe429815cbee1fb78ff33d8d6d1d967c
  • SHA1 49ca2c1ea711e35d8c62066bc6f470c3faeacf2f
  • SHA512 5e75360087332baf5cb2f2b7ecdca531bd765757c164552d32d3c9ba96dc4300f2159a1a3b5ab713311880bb193c874a5f5285d5f0fa33990de3b657c09c9db1
  • SSDEEP 12288:BrdjHS7xNL5ls/kGdgBiw2xArfkwCjla2PkXKaBJP7D3F1JpK6zKy3zB:BrtS7xNLU/kwG198lFPkZBX3F1JpkIB
  • TLSH
    T1A7D4F1B139019A50F47AE2BDE69684047734FCA2D903DDEA5304F5D31CB329AF94D8AB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2