Extracted

• • Target

    PO-04375KTG.vbs

  • Size

    313KB

  • MD5

    92cf45fd34496ac41434463f0d02f4a0

  • SHA1

    d5027385be35f4ac68b622aa993b9a568ac16ac4

  • SHA256

    0cfb6932e490ea78f85fcd57fc9bda95f274867dfd0dbcb3515bb1f7009626b4

  • SHA512

    80597f875019d1fc4ff7999de22c355309bc15cde17195ada4bc4be5501240c84a82e8e657446684a8ac4de3b26af5e04121abe6cb98fdcb4f610163fb6f176b

  • SSDEEP

    6144:x+YqqUnWShek49zVzVi+9/Pwy/4qXeV0b6bEWAChB/BpKhp69:50Tl43zViQFeuriB/B2U

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2