Extracted

• • Target
    Request for Revised Quotation pdf.JS.js
  • Size 3.5MB
  • SHA256 f14655228657a022190bb4c10effad9e92f2c5b77e14f56ee2b747129dfd047d
  • MD5 3cb5e2d4baf59a7ae99743b9cebb22c5
  • SHA1 a911c630cd03e642fac70d5bc5a164456fd315bf
  • SHA512 5bf5c79a81b638db7520c2d81d5dfbe12c52e96afe5607e5659c55d2de2cfa53cacf49b93556f95432fbda2149995891eee5b36a1d79f720155700f2a1950910
  • SSDEEP 98304:qk7IVyPGlTIbeZ1UcEafaWyajBk1qWvkH089zZuk9omjUf8:+ogcKQcVf33tk1qW80A59NU0
  • TLSH
    T101061A40A72D5879602FD32CF033BF9C454E20076089EF6E38695964BA56D07EF5EAE3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2