Extracted

• • Target

    OfferRef0094.vbe

  • Size

    10KB

  • MD5

    a51ed306c14c21ca72ca83e08a9ef09f

  • SHA1

    773ff6701795750856b76c16ff52d454849d7eba

  • SHA256

    a04dfafd9b29c2bfcea406d0b0cae7500f349b6266a0f6a6cda47616597e7653

  • SHA512

    ac6903f3095a1b5a5c2b389457a5243bded37ea0b051b94321cedac7298fb3cbd78c133823900feec489b51e929977c0889a0258d01292afb2266d89122f8610

  • SSDEEP

    192:aPDnrW7aSxew+zwqBP+ZFm+qq+GhQTHAiKaEVK:AnrW7aSxebwrmjdGmTHAiO8

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2