Extracted

Extracted

• • Target

    Enquiry.js

  • Size

    596KB

  • MD5

    105def88c4331e85779e06dbc7c00e3e

  • SHA1

    fffd01668e5e89070dfcfd6d00a29c1a61dc24cc

  • SHA256

    a628f04e39961298f24582de4663c75526326cba75a8271930c1af8fa38fc4d3

  • SHA512

    99b5ccc6b37daa57d448a0c8aa006e329eeb241412a6035ae97e2128c7e87917457db64b9d8f11b34ea392fe7e754eaad5ac5f1dbe16c42b0b4b1e3de1f7d653

  • SSDEEP

    12288:2EgoQ9/ikF+jw136w/wVMQr0I/A5ez/3yiQRQiBLXA0kRo824N5xsGJ8xFiVuSOc:dBTYgQYvp8sR5

  Score

  10^/10

  executionagentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2