Extracted

Extracted

• • Target
    Уведомително писмо ЮЛ-R.vbe
  • Size 162KB
  • SHA256 6246d3ad7f6bcf0ed3d1ea9012bb7de4c9cb2b62ae988fcdcfe372ae97eabb2c
  • MD5 0e83d1f7a2f4ee349260e95dccd1ef53
  • SHA1 6a1234a22430ba9a2da72a899c93eddb61a14d96
  • SHA512 f29bba05c017b6f445b80cedc4a529d940aea91a7768c3e6d99a612bd954f79679ad3bde593829941d600b0601ca0b5d454ec8aa642c2dc8e2f44b34025a062f
  • SSDEEP 3072:sp4yENVBkYr4LhpVXpKnupn8kH3DPbkhZi3eNR91OiTxK4VWDULgkl3CU2+:sp4yENVOY0NpVXpK68kH3DPbkhZi3eN5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2