Extracted

• • Target
    PO_#3334.js
  • Size 1.8MB
  • SHA256 62b5b78f80d371eb50e98ce67a45df37192936498e88f2184366631c95eb81db
  • MD5 30311b353d0d58b34e7c1d855479a16e
  • SHA1 0d01413b0b092183bb637314bdf9198bccc159fd
  • SHA512 fa679f145b4be7bf887c734bd7afd278bec785d2c6ae5437c1e88aa6a8d67df6a33cafbb6f953a60aee6135091ca93141381a9622baff5a1539d9c7b815ab26f
  • SSDEEP 6144:HPf0UMLCCb8jP37ZmkmdTnRkUIteM2wKWYfk8Alqu:4/vw
  • TLSH
    T1AE85D728DBA24A599761E72A4DFA0446AE4F77933BCBDD0834BF0FCD43125E1A67052C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasionexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2