Extracted

• • Target

    b1f6ace20017902dbd10246ef780c162d7efa2c6eaa26934b45a784223c72293

  • Size

    5KB

  • MD5

    ebdb23546bd0e7f4aee2a75909460482

  • SHA1

    5e11c38b784b7337fc2cc6ab7100c0240476c7a2

  • SHA256

    b1f6ace20017902dbd10246ef780c162d7efa2c6eaa26934b45a784223c72293

  • SHA512

    b16b6573af01d2bd2314c5de1d6dd6e4cbe8080ae0b72fe9180c95f27034e69cef1b1e078162ce7783195f37050d72c9e27940b73203586cc3e1908841faf234

  • SSDEEP

    96:QN7IU07Fzr15ZV3J0j9b0xF6Q/0Gb1plVB4CXcZQfp:QFO7hB/pJ0xb2Fn/hpLCCXcKfp

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2