Extracted

• • Target
    july and augst NEW ORDER.JS
  • Size 3.3MB
  • SHA256 eb8ea776973850027c76e4cf567f68a7605b1f9d1db63d50a64b40d7a3b2e32a
  • MD5 20a1e61ca7c6a90fb95e094dbcb9f7b4
  • SHA1 c08aad261466ea6a981ceb23ba427d4065bb896b
  • SHA512 8146aedd657a16e8bfa548c694cd844fa222ec74b0719eab655e32523b4bc2961fa2ae7be2d132bec80aeccaf28eb4fd1b9b6a52bbeb617ebf94f994fcbeef6d
  • SSDEEP 98304:ft2mi29RFCbFu6bUSnctUDc5OiUzY6+tNC9yN0hvFfrDj7m2Ctj5JWzHm26cD4na:ft2mi29RFCbFu6bUSnctUDc5OiUzY6+y
  • TLSH
    T180F52C4666E861637320D7D9862DEE78D40F8453382A8F4079CFD638782DE8EE6447E7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2