Extracted

• • Target

    PDT9377823-735363563.PDF.vbs

  • Size

    339KB

  • MD5

    50430be7e76cee93bfb67f638c45db24

  • SHA1

    f367d92793ad4a7b6765a5ee2183a418c34c10a9

  • SHA256

    88c4fd970ee45f12ab4b95370a2ceffa64dc27b0da5e181f5755532aad7010c5

  • SHA512

    ae70b5fe2e4c110c6e7c5a2e4c38dae2a313630d8c4dc2cf0685986ad30a5d61a391d26422de228c015846f51ca2146d8db57aedc81fa95ae74432ba6dac8a44

  • SSDEEP

    1536:j89r/aDcWJwG0mtvR/Eg5lq1laktrO8MmxqMsTMBhuiW:Kto/

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2