Extracted

• • Target
    UNPAID APRIL INVOICES=.JS
  • Size 3.3MB
  • SHA256 a7997538e6eb4a88feaf61758fd2bf2d309bd59be0e8ed0640d70b79de6d2499
  • MD5 a974bbef5d9d2aab1690cc5ecd579788
  • SHA1 f1febfb555a0b9f6f203914181a40240c2e0cf0b
  • SHA512 47d2753029f38e650e216a335f0ebe1b7536f46ae43cf44937add5874ca73cdae0914812e60b89ceda2e5ce07764646c68ba89640e3607c60294d643f3afb7e4
  • SSDEEP 98304:2t2TAdxh9K3zxsFeCYqzS9ZO0tSvjMBHlSFgWSlEfEJwN2C3zhx:2t2EdxHeq0wOqTvjaYFgWSCf2az
  • TLSH
    T17EF5F7529BA471737320E79D963AEE39940E500326E9CF14395FE228791CE4BD748BE3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2