Extracted

• • Target
    Guangzhou Seoca PO-2601055-110836.JS.js
  • Size 4.7MB
  • SHA256 daa53c3817696b4112be21e343aae4e17bc1be1d5dab1727cc55b157e6efb1d1
  • MD5 b5e6d58eae2331e6588c37030c52b743
  • SHA1 6f8358eb0408bd6ff406dffb824a2e369944f2a9
  • SHA512 1febbd5789c4b009ad8e09f699910c36c7d79273b7efdd6974fb755f4c79ce437ad969ae85cfe8f285c14bdeab255c7b8f4bfcde2ab197e229d70dec858cb9d1
  • SSDEEP 98304:t6nqUazaBbH7t/J75XoibIbtn4Q/hAy+8VabbRqx8ZGpK6nqUazaBbH7t/J78:trdmBT7t/J1XoHnaT858ZGwrdmBT7t/2
  • TLSH
    T181363A0466A492C72A74D77A981D7FCB3D4A50F3A838CEC536FE8D3A940CF052E7465A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2