Extracted

• • Target
    Payment.js
  • Size 1.8MB
  • SHA256 2e7fb0d1e3065be0f30ad2d336f01afd718592b2d2493d26107efb127d4fa4ae
  • MD5 7e4a82b07c382d1c2c4fe2b8d99770fa
  • SHA1 a1494f9d240175f0cadab6bb1e0cc4b97a3b6106
  • SHA512 7dc710163c1bc89a139dd43d3ba3de9bada622662d1a76a22ed2248d329db0f3e44c6169d7166fe7d40fea7aedc51f815ba3b8edb93ce73149b8572f7b957a3c
  • SSDEEP 12288:c/kYXo62lIkakQiKPsEFTekVH1NLwcl+SUUBNzmzc4YeitCFr0Y0UNknr1jaletO:iLO
  • TLSH
    T10795192B9EE168BEE1F7C091A8B453C5783BB3B030BD047D98D703598A564891F9A74F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasionexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2