Extracted

Extracted

• • Target
    PO 10266_28-10-2026.vbs
  • Size 91KB
  • SHA256 fb52611af2b69ec2cdeaf0838d0bf04eb8909de4c7023dbc6453d48f1bc42d8b
  • MD5 4b5fdf6be4b90db10398c17e7c890986
  • SHA1 4720c56f3965b7d157eab98430a3b5ecd03bf9f6
  • SHA512 ab6428e67d8df3fb81a35253b2d9fe31286e1410ca746046a053be22b22377584b70442f3cd99d07f2ef64b4e8ccaf44de2a8d948089472b1e4570003d9cafcd
  • SSDEEP 1536:g05/QhR2dwdwO41XiY7kMEtRqAxB6MSV2vIOPqh:g0JgR2dYwOYXEqYQMSV2vXI
  • TLSH
    T10F931B24DD3699454F5F23DFEC501961D0B89D3A011328A8BDCE2309578AB7CA7BDE3A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoverydownloaderexecutionagentteslaguloaderkeyloggerprivilege_escalationspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtCreateThreadExHideFromDebugger

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2