Extracted

• • Target
    New Order07202026001.JS.js
  • Size 3.5MB
  • SHA256 74dd5ea4d8e0b1fbd163fb30ef75944d28d0c852862abe1a95bd0dabe96198bb
  • MD5 85c4f53025f33afd1497c2b3ff4dada1
  • SHA1 26af277f84280db420faa93758a5e42d22fe2679
  • SHA512 a42351839bb8361f7986f636352afc14d1f26956389ea44126e66af95e5e1b965dbd27ff850bfcdbb8c3e307e69296624f97bd7577843c3181311fb8cab45395
  • SSDEEP 98304:Fu617CBZ2BT0Ln4b1X0LW368VosLgtERLxxlss7WGldyolG/+aWIyJSnkecJyWQx:Fu617CBZ2BT0Ln4b1X0LW368VosLgtEK
  • TLSH
    T173061A915AE5B1233731D7DA5629FEB4C10F8D0734194E5075AFEA38B81CF8AE6A0363
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2