Extracted

• • Target

    47fb37d285424a155defa75f5788442f68228ca67cf3e07d156f10c9b621e2de

  • Size

    17KB

  • MD5

    a7c2edb4d802f4195a1370be0063422b

  • SHA1

    30c32d08e7ca9dd1fe3cede09700947530c53ee2

  • SHA256

    47fb37d285424a155defa75f5788442f68228ca67cf3e07d156f10c9b621e2de

  • SHA512

    069ba00e62335b61550dca3c37422e054f5fb17cde5d7d8b999c2abcdbd8ea193daab3660afb2cf621ad2db43ea6c85f82cb69fe62dfe3f658d678048df5fafe

  • SSDEEP

    384:bZEeqBbbhht0F0o9BHdJD/UgdSmqSy65TGd:bZEeqhhhtzorHdJD/UgdSmqSy65TGd

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2