Extracted

Extracted

Extracted

• • Target

    5ebaadc4e362a1edba519f257315616eb0ffe4f42128d815c3aeada39569736c.js

  • Size

    226KB

  • MD5

    9e63c086b6be3311a1bdaed1267e34e3

  • SHA1

    54a735620f68a8f91858058197bdf1336cc6d0ba

  • SHA256

    5ebaadc4e362a1edba519f257315616eb0ffe4f42128d815c3aeada39569736c

  • SHA512

    b377ae7cab1808ebfc38f7eb4fba7d50a401e60f700a5f8a6d3830eda9161f207624b95f49c09fda65f0261d30d5db622679e764bfb372015a350188f3f928dd

  • SSDEEP

    6144:EGLdt3xLKZu3Y82AaRX5GLdt3xLKZurGLdt3xLKZu3Y82AaRX5GLdt3xLKZua:rLvhLKjZACULvhLKdLvhLKjZACULvhLE

  Score

  10^/10

  executionagenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2