Extracted

• • Target
    INVOICECOPY.js
  • Size 343KB
  • SHA256 c140797c9149ceb0cc39430a291caa6dfc2f92cd07d5b6b15cf6758f7093d7b3
  • MD5 18e6ad4f59f6d46c01790e60b5f1324f
  • SHA1 260f33b8c16fcaf0d17417ae591b1351103dcafd
  • SHA512 11869d3df3abd17303d4c74c334ad516687edd778e40abf22a422194b1372110bccfd805cc6b37bc40446545fc5d011c01ea83a19621da51829587b1c523fa3e
  • SSDEEP 6144:o5w1ryc8Nc5L3kPm/feKvIYYAA26FuylaFz6rhvVeRrsExJpXdawLyQC9NOd:9ryc8NEL0Pm/GKA5FuylaBco9nFZLyQv
  • TLSH
    T14274494263EA851CF1F74B58AA7A10614AB7BE5A1C39D02D15AC140E0BF3E14DDBA7F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionagentteslakeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2