Extracted

• • Target
    Objednávka_wd236000000000000.js
  • Size 28KB
  • SHA256 4d5a7038c4db80a2640afb7478e08a7747fa8fdad7889bd9240b3ad62d895f52
  • MD5 4122734ec0c03d2be93fd0676fa12595
  • SHA1 b40c4c9a9ee3d5424b1bf882f60cd6821a190970
  • SHA512 f215c406d2b18bd8a29e89044e7a4f3f9e81964601da721454d220fed639783dcc28d49fa04b5c6f0d24bd1513389ef0d9c6f32b6c9c40a6a78853134da0e2cc
  • SSDEEP 384:uxG2KZIxeXeYn5eB1BLzi+uhx1HUaZBBBuF16SPIZIFvMmaD9yI9Wi7cejI4pD4:JDa1BLzM1dZBXuF16SPIZUEGI9Wi/E44
  • TLSH
    T1D8D24B48BF27067787923ACDEF89CA20CDB982054A157070F19FDB5D5622AEC92794CF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutioncollectionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2