Extracted

• • Target
    BIK1910486_20260618.js
  • Size 655KB
  • SHA256 36436e163209fd79020f7ebf1379726bd8c4709d38452d6b07dc281e1f2ff1be
  • MD5 3e8157f2aa93880e46514aeb9e0e43d5
  • SHA1 9e2a7aa89065b3c8eff8e5f2dd5de1de46ceaeef
  • SHA512 5f070ccd5a9614048f6fe6630bd7e24c39669d6e314f582687f52ed493a9ce9489827500135eb59b13b272d05611ab2d107c7a77b6380de0a8dd2d83670f9a9c
  • SSDEEP 12288:lEv6ZqDtx04b+AAq6kTwi6Xu3fL5ONn5nx93iquI60r7whgC3fuRhR0hL7FBr1cs:lM2qDtx04Srq6kTwDXu3fL5ON5nxhiqM
  • TLSH
    T1B8E43970DA20017B4F87AB9CBCA50661C66DD325862705F0F6D98B0D900ADECF7BD66B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarecollectiondiscoveryexecutionagentteslakeyloggerpersistenceransomwarespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1