Extracted

Extracted

Extracted

• • Target

    20250120.js

  • Size

    155KB

  • MD5

    fe92c7ee393a2c87ccb3034c9ce18b14

  • SHA1

    8d2c9d5a5c985fb4feb466be1a4752d67042f4b7

  • SHA256

    85f2eb1ab28147d1353a0dbcc5592dcd955e6560e7a33015a303717c4b588d72

  • SHA512

    1adc6de119ce2090ce0752ece5d23e84dfa77e7ebe4505f7b4c5ef206808962b623d527cc888f2028e585f83d7261c7aec4241b90912c2e070eea38791c99ad4

  • SSDEEP

    768:loXxTexWHGJUY61tqTo7RkIwZnBN09oavEug4zdv9PCX9p6FHs5+hAQCx8PkYWXb:QTr8tIInBNKduYM5lOPTWf67ZqGxiZA0

  Score

  10^/10

  executionagenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2