Extracted

• • Target

    Documt736098.vbe

  • Size

    9KB

  • MD5

    8113e63e2ba4ac63a4621b2d9441524d

  • SHA1

    05b433f2cfb14f9d1ec947e32a496c45a2cfa22a

  • SHA256

    d5d3a7f4ca9b374465da72f550cc5a04e751c6a4ed18ab917a304318a9b4409b

  • SHA512

    730e21b73e6320146c53dd9092246578a476b24efb6dbcd902e905df05039274cd2adf76293e54e1d9a3cb01e88d3800db867597bbffd979ecfea5729d4d62d9

  • SSDEEP

    192:egjmLPbnOqiR2jutyT8vPka6hfuIMynp9KAvPxK:tjcPbg2+yT8HkaTTqp0AvQ

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2