Extracted

• • Target
    Zamwienielipcowe.js
  • Size 1.3MB
  • SHA256 5c98c01f6e0f8cabf2d5243000b4630b2c23f8a4d65510fb9723e53e33d7b415
  • MD5 bff810fe8cb278e3ae534b13d671d3d8
  • SHA1 a1f73b95311f2e086fa1211e9e623650ceddad75
  • SHA512 cfa9e6acb9998824ee4e0c0026fdae78510bab6460efb4f4c070ad884cac79bb22a6259d015e3e74ee85f3b64e4b7d80723d15954b7657a57376fcb60c9d3493
  • SSDEEP 24576:U/8O/hvdB4bwjUQ0xYe/DDQhFY+vABb4N+hneEr:6HzxvmQnYRr9r
  • TLSH
    T17355014619C47FB5CF9D5A2D50FE261FD3A04E8A9416A489FB23FC4AFFA7604421B1C8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionagentteslakeyloggerspywarestealertrojanadwarepersistence

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2