Extracted

Extracted

Extracted

• • Target

    943869c0fd11cfbfdbf3ba902377e1470be12c94a9f2d49c952a14a9700552b0.js

  • Size

    75KB

  • MD5

    2e461076f6618e8f34ac4ada5bcc55fd

  • SHA1

    343a6c8b272ee7c261c9a3fb1eda91f769cc18ed

  • SHA256

    943869c0fd11cfbfdbf3ba902377e1470be12c94a9f2d49c952a14a9700552b0

  • SHA512

    c4d0fc5f78321824c32493491cf0e29bb50a24294eb08e6934d206e4adeaa1aa1f7ddc2f443fe5e4ba9bb8d534443af61e9bdb8578573c66ab2f2b754d599985

  • SSDEEP

    1536:8Z4xzQ6VsYE/D5OK1hoFPqd50a+X7psEBCCB29f+JrdWXOUPmMcA9KBwbBs:8SzQ6Vo/9RzY

  Score

  10^/10

  executionagenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2