Extracted

Extracted

• • Target
    SWIFT_MT103_001_000223346.vbs
  • Size 94KB
  • SHA256 a1e0dcd3e9e25b1e09853d062bfb4d4d86dcf8bd2508dac7bd72c82b93660a73
  • MD5 6968bca2a0e748483ea287a3ca2daa31
  • SHA1 78ba452b8d6ad05b6a8662269649e2e0669d30e1
  • SHA512 204c0b6f7f85f929bd734067fe97c49dca3e5a9e54874b4da84f8eac53caa48475d1e14842434f89d9eccbf311da7655f077e01ff5f6bf825015a7a0af54939a
  • SSDEEP 1536:tyxitR3phhwAttLgu+iDTAqAxBVMficvg1+0tkFl:tZtR3pbwAfLdsqYbMficvsS
  • TLSH
    T1AB93D42AD93C0705CD0BDF9EE858D9B18E78E506853B10E1EDA82F495406B5DA3FD28F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerprivilege_escalationspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2