Extracted

Extracted

• • Target

    order_svea.js

  • Size

    1KB

  • MD5

    7be8c7cd89a5fbdf8f9e4590a3671946

  • SHA1

    ccd588b6aac0cb59a41b1c70d565f91cbf08a412

  • SHA256

    1ae589f7033b509d9f1132e9e1159fd3185860f67544e95bce6055849c96b2c9

  • SHA512

    ef05dd630844ea98b5d57aa8573bee893ad8fdd6b0530c975ac698d6334c602b0c5a6f8f6c740f74a127b4c6c2b62d64dad843b32af933112f14b69de4580888

  Score

  10^/10

  executionagenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2