Extracted

• • Target

    FACT AZUR TJ .pdf.vbs

  • Size

    272KB

  • MD5

    c62241a4663adb2e2987b1f9927a3876

  • SHA1

    99524951e2f43b0e5f542acced20c2e7870a91e4

  • SHA256

    aa615772cbee140cdb126f54f2fdf72cde32c38ab934d0a46a9bfcea31ca8002

  • SHA512

    a07aa4633a82a39b1688b2544e5ed36d796c9da470deafbff83fa506234e665c89ddb77f2706c8084e20038ffe99b0b24eb5f2f84b7966b27988eee717c0cedd

  • SSDEEP

    6144:U5h1/GPWvV+kcuUxouBmfgbtosqFH8sBsnQAViKiDDCQbJPQf2/7cgU1bLE3BE+Z:fmFb0mD

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2