Extracted

Extracted

• • Target

    PREVIOUS REPEAT PURCHASE ORDER.js

  • Size

    9KB

  • MD5

    a72a4dbbc967ec018310133e45d6af01

  • SHA1

    72edb7a0e614564a123ad68bab6bf68763d8226c

  • SHA256

    0a7b89d553db24732595f6ebd09ff05a954084fd5046b6715e7a48a05ad5e7cd

  • SHA512

    7f971e386c7af8235d9ccdaaa1ec0c87e100705d681fa0082920ed1947df28a7a4cc757af98d5b3ca54660af63e53c4b2090dfb364c242f19f0198082ed2f3da

  • SSDEEP

    192:gNVZjxD2SjlKXSwctD7Uzd9e9ac3VpRv5iDOgRLzGgjphitaKSud239x3YB1:gNLjgSjUCwCiud5AqgDI3yxIB1

  Score

  10^/10

  agentteslacollectionkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2