Extracted

• • Target
    TransactionApprovalNotification103.JS.js
  • Size 3.2MB
  • SHA256 f605ae07afe747e93b144d05e3b7ff26caffd287176b65d2c7bf36b7084afec2
  • MD5 b449564a5e0783d32f424a12d0df326e
  • SHA1 b83e0a638b4508a277d023893ab83a9ab9f8f1a8
  • SHA512 ed14cde6c5db625b2a518fc1b87ac1fb79f6f133723253fee9d23c8237bebe1fc4bdbacfe7a689f84972b49471eb596d44a8971e2c25679fd7113ee38c03e205
  • SSDEEP 98304:YtyaEcLukufWKxSpSE8uyVVW6hdBFm62rB67aQJySU+FgeTt0t504DLKtgVpbYbD:UyaEsgA38T24dHE67aQJUneZq57TVRYH
  • TLSH
    T1B1F5294117A891777320E7AC563AEE78940FA40328D9CF15745EEB387A1CD4BA748BE3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojanadwarepersistence

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2