Extracted

Extracted

• • Target

    008460102.js

  • Size

    2.5MB

  • MD5

    bba07c7c35aa193fc88ada6ed9956b4a

  • SHA1

    34313cdbe727f52267cdb48b9ef4acea839f4821

  • SHA256

    e35016186e8dff3f9ee75a334d35070c5158b0c0decd15dd93422370bf606240

  • SHA512

    fa5a40e44e634b94a967e28c2df580808a3b0712f2b379be97263991eae9d500a4cec682693d15830f165cda2c41da02208c33d74c67b77ff3f3ca18c2473856

  • SSDEEP

    6144:8zqVR8dQUuv5EXuI4bgVFLKEOyH7ahd8V8qjxhL8sIJ8mu2oOs4wnabH/rwGgArJ:Z9kCT1b

  Score

  10^/10

  agentteslawshratcollectionkeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • Nirsoft

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2