Extracted

Extracted

Extracted

• • Target

    7a9213f8719cf4d04d44e17846fd121c58a3f6d4bf1ffe834836c8ae746b248b.js

  • Size

    73KB

  • MD5

    3c59d737f35d68bbe2e3b439f5b2721e

  • SHA1

    348a45200e40b92d6568dfbd84645da895d071e2

  • SHA256

    7a9213f8719cf4d04d44e17846fd121c58a3f6d4bf1ffe834836c8ae746b248b

  • SHA512

    0b73c8d15fda1e90e7a892c33716e0393ca51a24d404a1ba2146988d2dcab7b9889fd331ca8a1644d6e299d80f3dfb29079ebfc6bce7ac409105d4e7473f84c5

  • SSDEEP

    1536:0Q4izQ6VsYW/t5JKtxG+B5jIWiHKHmdcAEGM6vax:0OzQ6Vi/vdPk

  Score

  10^/10

  executionagenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2