Extracted

• • Target
    PO for samples.JS.js
  • Size 4.7MB
  • SHA256 68342135a1fc950275e20600e8ebbf62258744f26adae735a73fff741d75aca8
  • MD5 144175e6d925911952d00c93dad50d83
  • SHA1 1a559dc4687ef44ae46c9669eb598189b0c11883
  • SHA512 58c037e852061e6b7070082e9f812a39d223a673f2a672bc70e5e2863fa975e44ca08a48cabd0230a6e0a1bd94edd69c2f32cc1725cf6a935383ff9211911f6f
  • SSDEEP 98304:Hkom3KDk6Y4O3RbAfysNqSJ22g5h6NIK7pomi0NngixJ42iN9iuphrZgmkom3KDj:W3KDk2+lyNqSJ2nsH9oT0Nng4J5ibTac
  • TLSH
    T1F636F6415B94E173B324E79C923AEE38540E601324EADF1438AED728791CE47A758FE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2