Extracted

• • Target
    SOA JUN-26.JS
  • Size 3.5MB
  • SHA256 2d240c03f3afd03e0498f5afb28d6004d56a3a5c95effa9e5a685b04e5cfbedf
  • MD5 67f8119d2f35e809ea4340554d62e185
  • SHA1 ed2dcd45a1462bc240fab3d15da471d1dfb70cf8
  • SHA512 24c9cc4c084c455d2f53ce0076e8c9ed579f36a2664300b9450247a62d464a43a93f6fb94513fa5d8ce1beb3a5ac7960e411c35ec6b7b34b713eb8375695224f
  • SSDEEP 98304:91DQW/KrW/6w0WHcloFXdkOgOUjMMIa5oOYI7KLdqJPHd/r:P5n/FbFXOpOUjMMIa5o2wqJPB
  • TLSH
    T1DF0618149F24A132722ED32CD336EE68990E600338D9EF5C756D9638F56DE07A3586E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2