Extracted

• • Target
    PI No.358 - SPB ñ  FCL.js
  • Size 1.9MB
  • SHA256 463fe863a122df0881233e8c579f459a47e215021c11fed6c4d8412d40a13048
  • MD5 0a1e760ce8fe45cf1fd69f137f0fb1e1
  • SHA1 ed0197506702343ca20cc6f4b4253cb5194e376d
  • SHA512 b9a79f17fef828ddba4137f71e8d9016f6ff1dbd784b555d289428cc00e2a776cb76e3fa433a4b1f33c9e668f994dc10b9a0c5483896e89a333cc4fe69c585f4
  • SSDEEP 6144:2MlIoawbmL+/cT4G6kgQXo1Vv3sgYQ0hFq:2MlIojmL+/IH6kgQ41Vv3sgYQ0hFq
  • TLSH
    T14D95E71AB7BC830E6828BE047EA16CC6B55D1A457FDB9512C07B9FCE0F2D6D09172329
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasionexecutionagentteslakeyloggerpersistencespywarestealertrojanadwareransomware

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2