Extracted

• • Target

    maybegetbestresultsforfreshfruitskissingaroundtheglobalforyou.hta

  • Size

    489KB

  • MD5

    eef89c197ece4474ec384b05605ea5a2

  • SHA1

    5cfea8d7a298c750f94c7099d8f0caf06769e7ae

  • SHA256

    bb1335089156b719f0f0bc2bbff00223be438742317b106484071be0f175702b

  • SHA512

    e6ad3af108ea231ee3004c78767739e0917de533a19d57be866eb9a2a04ace6bd8cbf974f1479bb3cb395887dea93af5f9819d012a3ad804a01df40c4a3eab3d

  • SSDEEP

    768:PEppjTsqUYHtObsa/ZHI8PbG2ZDxQAU0AGFtzXhyT8HPFAyRfSyn0qivXE1yGK3P:m2XPQf/GFtzXhyTGPFAyjn6

  Score

  10^/10

  defense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Blocklisted process makes network request

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2