Extracted

• • Target
    shipping advice.JS
  • Size 4.7MB
  • SHA256 d82dce851c21a86481653bca3c5e1824199c2030a8fa51abd44c5cab600ca6de
  • MD5 e27e87c77da69ca096d94174432877d1
  • SHA1 3ecd2b15d18c9146c870bb56e6688ca8e05562d8
  • SHA512 b323d4d8196991a9364272455120cf7b60d7db67d5ad567f5125ddd281873e9083a30dad34f1dac2b68ba387cfe29720c7ac50e3f6fb71a2271dca7c8621751c
  • SSDEEP 98304:pJAKaNqDGuBJxTVcJsRV0ArLPvXGDp4q4gmXx9ngH+jtBeRlMJN/IJAKaNqDGuBn:xaYpiJWV0UvKpC5ha+8yJJkaYpiJWV0+
  • TLSH
    T126369E908568E18760A8C36A840F7FED190DE4077D64DF067A9ECABDD90CF42B65C39B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojanadwarepersistenceransomware

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2