Extracted

• • Target
    PMT#454778.JS
  • Size 3.3MB
  • SHA256 ab37d91637ec10999dd53e2e2b5471e8b06cf17ec256fae8121e260dff9f4755
  • MD5 2cdd70dbc15fd2f4bd27565865d1bac1
  • SHA1 4f3c2d36625b3f62e0e31d91b011558006ac20e9
  • SHA512 90c138915e35850c0777c3857eb844d4ee331fdfd787be7706ad7775e9741e525496e4f06b25f09495dbe7a00ab2f576fad31bd6c48be3a0de6e0e0f08d3c5e7
  • SSDEEP 98304:fxYzjuTwJ9EN3cLFGqm7EOWFN/36DJqiP4:W9EN3cLkquEzFRqh4
  • TLSH
    T108F54B158A2CA970A56DC32DE03EBF9C058D6007255CAF1D3AFE0624B656F47B38E5E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2