Extracted

• • Target
    BESTELLUNG 220626.2210019.JS
  • Size 3.2MB
  • SHA256 aa074f6fbba3f59dee6a35e693b85e1958aa95325e8833e897fdc12d807e1023
  • MD5 71914216d90228db536c7bd28cf3eb94
  • SHA1 f63b78a9224a837ea16d06b6ba9e7592068f7145
  • SHA512 328b5f870dd13e30a6465b016c5ecc605af36863437dbe17c6ada4aa7a3b48c5ea850a1c417b9e9aaf1008a4a3290425966a79fb624863b7e31a3b7569f44ac7
  • SSDEEP 98304:sY0apuSol3LDbifMXtDEgsLEPiV3gwFgiIKbdx:sQolvbiMtcEPiVQw+Qbz
  • TLSH
    T13BE519915794A2327720E7ED9236DE30990F641314DACF21302EE328795CD8BA79DAF7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2