Extracted

Extracted

• • Target

    scan_374783.js

  • Size

    3KB

  • MD5

    c6b0c8c717d6f6b0fc0747c349821280

  • SHA1

    e7b0686c4eebc8285ae5a2eb2c70a602b451b0d6

  • SHA256

    9eb68fe0683e79b88e4b37a2b038336192b516c5f975bf8636dc1565432bbdbc

  • SHA512

    434a2c6fe2ff42715e1ea6807e37d40852aab4ce0cac8af7ddd52327f503c72eb5544f221c15080b341942f6a79b9279679dbb04fa8216e2d5616c53df0fcac7

  Score

  10^/10

  executionagenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2