Extracted

Extracted

• • Target
    BIK1911486_20260507.js
  • Size 349KB
  • SHA256 55897a63a54fd6421abb0c83c5ef3a839eb5adf1bb60bbb57d5118f52789bdcd
  • MD5 7680b3805a811f89e58ec0753de19352
  • SHA1 160b752d0f4d827b75e038bcf63b71807caff4ad
  • SHA512 3c019f40b049274b24c6a74f4f58f69a469f69a723e1c2fd67bf9cbde430069ace82bcfa57295a424292b10ac588d6562b69f4c371261b776dccc3de62b6d5db
  • SSDEEP 6144:GlGjTUUUnv0sk084Jrs4P/kGVd6R7z7SZyUYbA/c0/XW1/YbpDv0D1/s:DUnIksNY1YsXo0
  • TLSH
    T152745C20DE24067A4F471BADFCA50BA2CABD8619422654F5F6DA030D60065FCF3FE769
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoveryexecutionagentteslakeyloggerpersistenceprivilege_escalationspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Use of msiexec (install) with remote resource

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2