Extracted

• • Target
    Urgent part P14797-24-A.JS.js
  • Size 3.2MB
  • SHA256 f1511d38d6b64d36bd649cd9f39587b8752b4124c64e0740ee6ff094d4fb1b23
  • MD5 2c88c3914bfa18e03e2a98b11130824f
  • SHA1 9e9b7c9f271366214be5fbba9b34d61dbac3f5b7
  • SHA512 776e4c419ac7c49e681e8d7f416b8c90c45d7e76768c357eeb69808b882750e4429ee4b15ac580c7f02ce3ecc63a5a10c6cb203fa84502d81a58c1ae41cd0508
  • SSDEEP 98304:T3JdAdsSghU05itONRERLjka3hYDjWAKz4CLuvxxgO3z24inDgNav9Y9g0sS5Mdj:TZdAGSpXwDERLj93ODjWdtLVUz24ODWO
  • TLSH
    T1FAF5298117A0A1337760E7AD5237EE31A44F681319DACF10312EE728791CD4F67A9AE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2