Extracted

Extracted

• • Target
    RFQ 67646.js
  • Size 1.6MB
  • SHA256 9c0eb19d1579fbc93030d42465b90e092889b930733ffda60b5acb137a346dac
  • MD5 bee96dd6dd3f1b7452507dee0b0f6923
  • SHA1 071ec523c70a4654e66dbb257be1ac4071b330e7
  • SHA512 da3f18f7144736d3730a4685bc8aeae425d52778e3c819cfa08a524d665e64f1d1c466dcc6cac4ee8e3e1b453bfad2cde81e986738261b60c9cc04ac4eb0dd21
  • SSDEEP 12288:Ge8IEdPRUwn+VpabD+WeKlZUQHstoMMAsfo:gPRbCu+AAko
  • TLSH
    T1D9752335443DB2003427EE76C3AD64DADBCD5AE9BFAF51494036174A9227D8BCCC226B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionxwormpersistencerattrojanadwarecollectiondiscoveryagentteslakeyloggerransomwarespywarestealer

  • Detect Xworm Payload

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2