Extracted

• • Target
    PO250000Corbela.js
  • Size 1.6MB
  • SHA256 ee35b5d05f07596576285d90c29ad6932191adadcb840fb8310a12559f7605fa
  • MD5 b4c0f95547af870c6be56bb44d3bd656
  • SHA1 40b97221e8e5ba866941144d7ad3939a3ef70913
  • SHA512 a7e57e069100adbd57bcb4ff60b8035bb8ff1660d1578ceb62cf70734d685a761a468d427ba4068605e906c9c53b07f992fc14ceb2916d560de887a8a4aa7156
  • SSDEEP 49152:29Fw2gyqeWRcKlrZOD+hs4WF1PQnL+/KkhnckDHYYEwwztA0czEBfBI6zWAckWO5:F
  • TLSH
    T1B375E31EEC61806FEA73CFA559979AC2BDE1EE533118DC4091D653418102EA6FE8273F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasionexecutionagentteslakeyloggerpersistencespywarestealertrojanadwareransomware

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2