Extracted

Extracted

Extracted

• • Target

    Enquiry.js

  • Size

    319KB

  • MD5

    9234f26f1ef7e053de47d6b1e4e02827

  • SHA1

    f110e7a8c7d4b65491be0393ead6bc9c9620bef0

  • SHA256

    9446ab8aeba470c63142ab986f9023bf8b1a786baea6ff43ceaf3d945e9c8976

  • SHA512

    62091b83f6feda8f7cff0655149a3c2d6d7c4203b1064f52f670ffd759d0ce97ca243a87084b6f6fe2be96a8576d57488795844202c5210e577899e341225c7e

  • SSDEEP

    6144:zze4Z2bN0IWqH8dEHLQp57QBH/8vGwp749Og3JWacMnmockYAOkrW9vvplZcF:e4Z2bN0gH8irQp5EBf8vGwp74AgJ4qm6

  Score

  10^/10

  executionagentteslacredential_accessdiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2