Extracted

• • Target
    DELAYED SOA $67848.JS
  • Size 3.2MB
  • SHA256 2df114cb90945d04166400cac83c429292ce91f6a473693916f1a395b96243ef
  • MD5 c6a17e6941408cb907dfba96f7a1cd6e
  • SHA1 0228c8af4804979984833668dd61790fce25eca1
  • SHA512 5c326d481f17667528ecb3e4f4b26be46c69e8e8df431bc5a156b7b4c9b9344464ce12671842e86ee3eddf9f4b95b0cd7efb25dec21b0becafd3e0cd77b9bf13
  • SSDEEP 98304:s18BT9ao6oyD//tHw4PZ9an11lMJlMiS4gqvx/yNsqgToh3rL+g25MmfUp5DNEnA:08BTgt1D//Bw4PZ9a11l4MiBgQ/yzvhZ
  • TLSH
    T147F52A515794A2333320EBAD963AEE74980F500324DACF14355EEA28791DD4BEB58BF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojanadwarepersistence

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2