Extracted

• • Target
    ORD-202602104.JS
  • Size 4.7MB
  • SHA256 1a9f21532065834e6648a77d0dc646232f254c06a83676d700d6662f0433bfdf
  • MD5 2d99c2653fcb461f33979e7749133d4f
  • SHA1 b3dc633c44008d8882b0164816090ecca5055e88
  • SHA512 bffe05b93c9bc7c60dc852023a9d3c9aaa12ae996e30ade495f0b589d1493afd151621927f506f2cd24a51848c9b0043c5402ec055b00a3816eba36c8f8bc355
  • SSDEEP 98304:rH6FbPyzZAykrqILoRNBfyTTlPODUgqXo8wpOtvP9QAyipaZXMxVFOl+WsokcYkY:Vziy2c9ynlPODUgqXo8wpOtvP9QAyip/
  • TLSH
    T111362B8666E9A1137331EBEE452EEF34900F945338068F6575DEEB38381CE86A714793
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2