Extracted

• • Target
    output_g7ss7xmq.js
  • Size 1.7MB
  • SHA256 9d132e36a9bf5385e2392eaad7e0b9ccbd14242bbcca422b160b61a22c580682
  • MD5 72b752ac811ea95fdaa1a79b46567330
  • SHA1 0153ac6718f9ccde6c69d97f4db7952d557209d3
  • SHA512 032994741a479f09aadd9082197eabe87fad6d30fc9c0701ad46b6b11d50c1c081d111af81c02b607759c02c35cffadeef5392d8e60a48414e2bdac900304f52
  • SSDEEP 12288:q0hr4wxUjkinFIT42lWN5sCixRg5QCXt38PF4isB:ghiw
  • TLSH
    T10D85597CC508401BE1F6E438BE588D8EEC672267B17D2E4C24C75A4B4617C4BBF8A66D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasionexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2