Extracted

Extracted

• • Target
    RPF1910485_20260709.js
  • Size 78KB
  • SHA256 92f018e919500a849805245b07fedf181a2a3f2bc34bd0e435e938bc8a72031d
  • MD5 7a6ef6d29e5de3215d83b80fe1428efe
  • SHA1 ef9c771ceae6eb626411b35e0369be6e4c7a0cbc
  • SHA512 6b3a2c70b7d196f0f7407e149828448b86a98eb834ad263045dce4ae2e098cb91ebf84734a9e13f22bea3e06e83157878147fc93fc8131af72d6d1ec0b36bd53
  • SSDEEP 1536:2K30xyoq8UY9bazW+s6jVBi282ZJsD780pF+NNUwl:2K3aogazJBjVBi25ZJsD78WF+N2wl
  • TLSH
    T17F834A70CA2101774F83AB99BCA90651C6BED318853744B0F5ED8B0D92099ECF7BD66E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarecollectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojanpersistenceransomware

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2