Extracted

• • Target
    RFQ-0001468BECRISA.vbs
  • Size 347KB
  • SHA256 46aa68905416dd159ddeb1fda44dfff4f415de0010de8c74a6ed0e902d7f9894
  • MD5 d2afe8e60ee033536b0962383cbea3da
  • SHA1 f5ed4123b0f0abdaa8f57606430c4a869fc3bf62
  • SHA512 6b67eb344dea4cd2074076e4b956970c2122b3c92e335d03712798b4a0eb503ed3fdf81a4ef32e62ed17fc50e2d0ef4dfa6ff16870f5932c90295c27c96c3293
  • SSDEEP 6144:kpr+LWeAua3X1RMGDF9MyHyLs/ynJ0MVuGY0t0DsOsSkm8S/cuJoakr8ESsyIJE/:kpr+L9Pa3X3MGDF9MySs+JhAG10DsOf3
  • TLSH
    T1F77412AB89C275D1F03B1E5F28995A7E822608E9435370417FBDF3E9B31131B1F48A66
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2