Extracted

• • Target
    06eb6bdc0278c8de4e1a1aeaa51dee2f7e099d1f417b090decc4743128dc5fdd.js
  • Size 3.2MB
  • SHA256 06eb6bdc0278c8de4e1a1aeaa51dee2f7e099d1f417b090decc4743128dc5fdd
  • MD5 f49e696bffa95238d80fb60a07fcbb59
  • SHA1 9aa6bc76a4a8d2dbf07ff22e07c25957602a6e6e
  • SHA512 432cd8c88f6835a395fd5bd22e412bc6881e2bbf11d6fca5191ef2823c24c3ef0954466dd607de9dfc423bee8a532291fbe8d7f548e5422b12b36724cb7d80ee
  • SSDEEP 98304:MBD1mGuJvQdq57MhAdRhWgxgjhMm9mtIJH1mO+PbcOuu9I:MBD1jXUeFgQOuui
  • TLSH
    T12CF55C509428A8B4BD3EC33CE0377FA0465E350B2119EE2E36795658A6D3F472A9D4F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2