Extracted

Extracted

Extracted

• • Target

    Purchase Order.js

  • Size

    133KB

  • MD5

    8f4dc9bb5911379994ef0cadf2953e0d

  • SHA1

    456a8ba07ceab3066f9fd12f73d4f5da34549e50

  • SHA256

    8906d935345492816ccfc993df85b2fb7d37519247aa063126f8b93e577090d0

  • SHA512

    8a83e2be903573e7cb04031ed13297c1a1c9f65f32b6dacace36c52e9b818cf5536cc23d067c873f390a37da5c69a830b4d42aa4314d119d548008d77b29aa0b

  • SSDEEP

    3072:gW5Bbi9oLFzWuLD1dsW66/Y9tTCFzxW5Bbi9oLFzWuLDn:+9opzWwD1mOGJCFzh9opzWwDn

  Score

  10^/10

  executionagenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2