Extracted

• • Target
    Quotation #2026-00518 - Revised.JS
  • Size 3.2MB
  • SHA256 6e4d2f46e8044b5b2eef31f02eb62eceef9591b85c548b586f0fed20674f2909
  • MD5 c7d3c18401e6a32bebc8ab62016ce6e7
  • SHA1 0400cb8c4acec701b5b83d751f6ee55e89e1b073
  • SHA512 363067efb9aba80e58e380d57b2c73217806ad7439d55ce355968df9550b79a4e65eeea8be31c087003d5bb4ce224f28faa790a0dcde7eaf478c95bac1e0e359
  • SSDEEP 98304:kAUuu2rui0Cp+ms1eZa6JOGWR7RN/jGxsTdDhhHcuiCRIJHTN:B1ruiBYneE6JOGU7RN/j67rJHR
  • TLSH
    T145F55C00A5A4A2C73978973EC41E6FDF784E90F3A835CE4576EEC93A944CF056E60297
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2