Extracted

• • Target

    8aca79c93ec42b8bd01a7dc5658d82c8282738cf178428ba68abfe64f2bfc24f.hta

  • Size

    164KB

  • MD5

    63144d8097791d805f2e04403fea9727

  • SHA1

    a6b828a4351d7d623e9f46ce3dac78f83a145f4e

  • SHA256

    8aca79c93ec42b8bd01a7dc5658d82c8282738cf178428ba68abfe64f2bfc24f

  • SHA512

    6fa04043272a24c1f5bc89fcb0a3fe954e16f51d1257aa25980be5e0517bcdd5e541a25fa01eac50b479b9c945db08497d76f5f4b1d264f0c86b4820ec7dcf4d

  • SSDEEP

    48:7oa+awjz7eWLB227r05bBqeTqfxtRzpyaLGf10px/YsfyfAgs80iJAT:Ea+n7j7wO3HZkUfy4SAT

  Score

  10^/10

  defense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2