Extracted

• • Target

    1293fa7e351537567377346080bd7307544d22c844faed1a26ba7bd9ed2bddd3

  • Size

    17KB

  • MD5

    fb8b70046cdbe6cd512b2484111f2281

  • SHA1

    f905a597e151ba220f17c38bd7d3e27e3c6ac33a

  • SHA256

    1293fa7e351537567377346080bd7307544d22c844faed1a26ba7bd9ed2bddd3

  • SHA512

    000f740e3106e549c771ac59d3dbfbeba488ca383422bbf6ebecc04d33b5cb7292b7bb2a221ac8b820fa7a4ea5711531a73cb77d74f5f945225c66f051852f0f

  • SSDEEP

    192:bdmMEe+s86mzYPAJtFdgSWZYGYfqPdA47PjLScSweS8qOsf1Ooctd:bZEe+36HCtFdu5Yfad7TjLSNLS8PJXtd

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2