Extracted

• • Target
    Scan0011.JS.js
  • Size 3.5MB
  • SHA256 341c6f83ffbe109aa8de4efcdcc19acc1081e70a2415e78ee464a177333a83c2
  • MD5 514e6a12f9f2f33235e1213773a9a3bc
  • SHA1 03ccdbb5303c896bd66673c309dc15361fee9fcf
  • SHA512 325bff1021f7726899c31c41b4ff7e1d986948485684bb239d60cc741bef6908133d0677b4b0e0877e8b7b690b1ccdfb386208a1aa51a5dfe30d14c55385cff5
  • SSDEEP 98304:HUvJUyPlIGgUfX5qk0CGjU3hGPZNv8wOUBOHwIcqCcw5fSbHnH1qJjZWx+DKy97u:HUvJUyPlIGgUfX5qk0CGjU3hGPZNv8wo
  • TLSH
    T10C06E8515AF4A1933321D7ED636DFEB8E00F4903681A8A54758EDA38681EE49F3D03E7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2