Extracted

• • Target
    INV-19365.JS
  • Size 3.5MB
  • SHA256 e3bd3cd6f3b1ef7cce38669885b2256a561d50a79d494f329472d0a1b2bdb29c
  • MD5 789314a40e354f813d19e0ee462a4f95
  • SHA1 c5b0ef6ab4f3f799697d2fca23b1f0adbac1069e
  • SHA512 17f5e5857d942bd1451d2f7bf1df755b1e98e6ca86001f1efe85904b3e5cde7d71fb161b1011737ba8836006aaf971028e70ae6a63c87089cd32b01a3ee7e7f5
  • SSDEEP 98304:8MOkpGnnIvL6Ha/FA1rdLUyKn/B80rcfw2O5SWlMgRAwAJqqPX1+jgAvCGkECMNt:8MOkpGnnIvL6Ha/FA1hLU3n/B80rcfwN
  • TLSH
    T101061A5197E522133325E7EA9A3DED78F00E90133499CB85B59FEA3C251CD8EB6113A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2