Extracted

Extracted

• • Target

    seemebestthingsevermeetgivenbestthingsfornewways.hta

  • Size

    46KB

  • MD5

    e90ae8ec16ea2056caaa64ac13a31373

  • SHA1

    8041a1bda3769b97d8e8b980c6a77fcd2829d715

  • SHA256

    df215a01f6a83014a148c6e407cdc8422e9119a88b4220a1321b2986ea9aef63

  • SHA512

    0e2387a7813adf066dab3ec72b4525cfb4965c3d124595165de42ea17e35055a2e5c7bbf9eae70568e2290cec9d627f742c23129730ec730a947175916c8fc7b

  • SSDEEP

    384:gLezlvdbmgM8m956YSmzBB5CtbHA7lvRvw:gOlvBvm956YfwTARZ4

  Score

  10^/10

  defense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Blocklisted process makes network request

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2