Extracted

• • Target
    RQF09800.pdf.JS.js
  • Size 3.3MB
  • SHA256 dd926a72da2310cc937a836fff17d4e8904d8cae232cfa2690bc942f8a8ea950
  • MD5 96f5700cec79755f7e2093b343f7aeaa
  • SHA1 1d01e16944067b27c53169452f22b43f99f376d4
  • SHA512 955d7fc941fecf29041aff5ced2037d3bf9a0e9a04ef7aa397a4d509ec2fb60cbebeb46372bcbc03853effbd945a570104dc46a64e515f1fa0f522e43746b9f4
  • SSDEEP 98304:aOn9yo6k9llWws87sWf4fLmTs+5PWABJazlp:r939PWD64jmTs+3Xwp
  • TLSH
    T18AF53A41D328A8B1A52ED32DD136AF9C0A4D2003359DDF2D39BD1634B66AF17A35C9E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2