Extracted

Extracted

Extracted

• • Target

    RFQ-CanparFFTradingCo..js

  • Size

    180KB

  • MD5

    0d3505de58b29682da0f4799e7812306

  • SHA1

    9a411ead4bdbed963fdbaafd5729a77a35e63e66

  • SHA256

    11d08c101934f51cee60658bbeb71a5988873bfacba3c00f25cea0bd67442926

  • SHA512

    c037fef1c0ccb0fff448d0d2344c3edfc2613529ee04133a44b29ed111df9ded4b79f57057edc02c230c68827a0d2b3b1ea3f32f6ce583dd80c61a81b064ef90

  • SSDEEP

    3072:94SWDYRx3twtUMy2xtn4BRGLGqlT6HYlxKm3+FmEM5SGDZx392xtn4BRGLGqlhG:xWAx3R4t4BRgjR64lIm3a1ZGdx394t4V

  Score

  10^/10

  executionagenttesladiscoverykeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2