Extracted

• • Target
    Purchase List.JS
  • Size 4.7MB
  • SHA256 ddf7bd27b9c15a743cfd8bda99df023cdfdf3af819a5c5a99eb828fe2a84e7f8
  • MD5 a5f1c7883fcf21663f5f50cda905e15b
  • SHA1 8c4b39f82461c69b99fb34b8cfd7d7b9574cc073
  • SHA512 b46234d10784245169b84cf9cca8d8cde31fa137bf053b601aa79a46d3975c36378e53ffb659275e839d8417afffa78776358651a42d69fb48063f37d5c1eca8
  • SSDEEP 98304:fyDLx4MJEgdNB1QqqjW77TuDkHQQodM3kbyjHd7D/y5klgDyzhNKK/HyDLx4MJEZ:GLx4iTdf1Qqj7y52gD2hNKK/+Lx4iTdS
  • TLSH
    T1913628208728A772657CE7ACD136AF34050E200B25E9EF1D34B85324B666F17678DAF7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2