Extracted

• • Target
    f08d6093ec330cca60ec8379b060f30c572045baf32ad217cdcd89b302d49b2d
  • Size 12KB
  • SHA256 f08d6093ec330cca60ec8379b060f30c572045baf32ad217cdcd89b302d49b2d
  • MD5 3e0c4e42389fda592b1a28fac10c696c
  • SHA1 437b51933fecfe38b41b1e192e67b1fbdd247dd3
  • SHA512 fc2dbed454705f5061cb31449b31fa6a2d3f2d6230dcdd62d8c28c54f0af8f7672098bfe6d72f859614828101d17cb283ded653a56fedf09ae8d3e8f1558ebe8
  • SSDEEP 384:cFAVp7Vqe8r8FHP64Dwd+m86GBOs3zX5aH+gaRYnVpPgRVVNNbgLLO:LVbGUHP5wgX6GYs3zX5h/kVwbELLO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  agentteslaexecutionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2