Extracted

• • Target
    Apia Order 2026.JS
  • Size 3.3MB
  • SHA256 b644571164af0e3c88bf860e7ea92e6b1e696c746e989ddf48d2b3db6d6ad0db
  • MD5 b6691e7b300a36b1f9b2cc018ed45077
  • SHA1 bccf9a9c25ae76ba1eb0de13f6b5081b8409b1c8
  • SHA512 78bafbf75dfd037b7751b18f6196f42928778f971f41a75ea464d83d895b113c25120341fe731696aa9e86974c85d4cabcdd0c1413e43f12c6894531b2fe0f70
  • SSDEEP 98304:bAxDd+/LJW+vmNy+esZST2zX97lFtwyr9yREZWj:6PLA7SmeRlFy6uEZg
  • TLSH
    T179F53A00832864716A2EE36DD03ABF68054DF443258DDF1D36AD4668FA5AE47E78C9F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2