Extracted

• • Target

    Letter Of Intent.vbe

  • Size

    11KB

  • MD5

    59958a367c15cc55b0b42db533eb99a8

  • SHA1

    06d169da811d8d0abce9280ff7fd748f125e1aff

  • SHA256

    5a793830dc868d92331342fbca7bb5338b6014944a972960c97f7d9d3f3c66ae

  • SHA512

    bc7fbbb16f83492876f298f98160b264150ee995871f0e2d59c5c49d703bf2f21721ca1d49d293264be798ef0da2b5ebb4f423be5ddc788d34f1369db03e546e

  • SSDEEP

    192:kn3g3XXH2AYKtbXq1qFqpSJ7sWfqH2hmqaOdC8NhuOzWNpK:uw3XXH2aA1qFkiQWfq2mqLdCpxw

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2