Extracted

• • Target

    officescan 1010SCO .pdf.vbs

  • Size

    272KB

  • MD5

    3dc581a23bc3d6115c76bc51cb512a53

  • SHA1

    6fa8254d8d81ebb9effc26b6617084dc0f97ae9f

  • SHA256

    457cda2f1a7e6a9082f3cfe7847a7d3937a5d7de90aefd06ebc5ed4f4255da49

  • SHA512

    fe3d49f400587275506eee35b7ee35e00eeb4fce28a1fc207aea7163fd5fb54a30e2290e08ed33ef04d5a06bb319f13e6ecbb3d97502d37fa88f28d7fa62e26e

  • SSDEEP

    6144:U5h1/GPWvV+kcuUxouBmfgbtosqFH8sBsnQAViKiDDCQbJPQf2/7cgU1bL5P08C:fmFb06

  Score

  10^/10

  agentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2