Extracted

• • Target

    Summary_MD5_8F4DDC090B677BEFE549D5B0CBB85ED8_Content-8F4DDC090B677BEFE549D5B0CBB85ED8.hta

  • Size

    27KB

  • MD5

    8f4ddc090b677befe549d5b0cbb85ed8

  • SHA1

    a052f5734500d1021574d375b135b4b79e7a6f64

  • SHA256

    d8eb8afa9dea77c71c1f7ea351338eb6025cac939b9cf090d9c17b2fa515f1b6

  • SHA512

    ce70c15760f9e25db1e8fcbe948bdf45e5b588f0b84bfb19245eed5057dfb594b21246300de448a1b652b20a07747ae30bc7defc92ad070a6257b3eaea27ec29

  • SSDEEP

    384:4wVQoo7G2gVQHzreXU7UEEBUKqhbzaJOOKIUUnzVW5Nn6VKK2:4Foo7PgVQHzxESKqhbWkBUnzY5NhK2

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2