Extracted

Extracted

• • Target
    004911_MT103_001_rejection_000223346.vbs
  • Size 64KB
  • SHA256 36f6f8a754e37a09b84478de5df78b39be9776e1fe6d43b2272c077bd7937d98
  • MD5 1ef946e16747334cb2acf1d1be16b34b
  • SHA1 fbc277d80d13c8391e9a25df276030ce99af7625
  • SHA512 f083527dceb7b6caa6fe4e1a3c88557efb3dd43951bfabe057d19514fd38cef182df3e72f08011dbbaff283b226c3d3aab2e6fd096b10cc954872f30fbbd20b7
  • SSDEEP 768:5mg/B7Ib4jw7c/jDODiivL1g7EesN0M/KK+LvhdjjuIOnRva6ZOXfdfQni4PuW+V:5mgGY6qMNlybDOnRC6gXSi4WWo/N
  • TLSH
    T12A530862D954016619562ABAE85C275587BAC22F02C300F2BEDC736E164F55CF3BF3CA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoverydownloaderexecutionagentteslaguloaderkeyloggerprivilege_escalationspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2