Extracted

Extracted

• • Target

    RFQPO.205710001QBMSPRQ0200140.js

  • Size

    4.7MB

  • MD5

    5e1cdaa87915b9b6e7d852c0b7ce272b

  • SHA1

    978f40e995fe1fd0e10f73f8b7924dd31ffb6267

  • SHA256

    3335d593c4a2f7ab94a35fd5a0991026d1800592a18cc842686d3bf6bb66503d

  • SHA512

    94e1811a87af0165989d69732d20f1c00981eeeb15ed976b01ff9afcdd41a38ff201252f8e003bba92541757603c29b80c69c897fc41cab51ad88b7698754425

  • SSDEEP

    49152:Dy0k7TbmSOqsmBdkQUUb/YnBxbb20HelA1mvpxVAm8Zp0v97quF8yAmhR/:2

  Score

  10^/10

  agentteslaredlinefozdiscoveryexecutioninfostealerkeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2