Extracted

• • Target

    Demurrage Claim 20250422pdf.vbe

  • Size

    1.4MB

  • MD5

    3cad1f3c2c6f0a5652402adb31314137

  • SHA1

    cfa7f80e00c931b0107ae8b9d588fea375fa8486

  • SHA256

    bce73437ffc825f4af0e0a4a14b5d2f1a52c55d324be9ad415b2ed257274335e

  • SHA512

    96ed0e88756c77206d187059bd39fadeb597466940265c8a35b40ba60b30fce71427e84ebc32806d96046fd0f82c1215f334cff97d81c5f70ebc881d7162a005

  • SSDEEP

    24576:Sk6YLtW+5pCOOrwBfeom3RDRoM8cLIRk3tAaLMgs4GM4IVj:Tmf5

  Score

  10^/10

  agenttesladiscoveryexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2