Extracted

• • Target
    PO-15408.JS
  • Size 3.5MB
  • SHA256 f5ea070277559ab22df313ff3682711d565cd2c34ad4b9506dc70bab03683815
  • MD5 425e33fd346723e477ceafea39accf4e
  • SHA1 b9909ca95e92f4e6dd684063aad32247f438def1
  • SHA512 61f7763c8588ad23875c267221391d95c6bee48911d1363bfa56f7bc70ea9eed0483131b432a45c24ca5696f1319c2424edc76e6d0ce133d5b775c262bcf58e8
  • SSDEEP 98304:ZvPzjwYItUdyuaPhPuVyKdrOPQCs2jVbOqb:2gyuaqYQCsKVb
  • TLSH
    T111061901D7247475126EDB2CD23AAE68524D6003328DEF2D347F1D28B666F27636E9E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2