Extracted

• • Target
    Project.JS.js
  • Size 3.5MB
  • SHA256 acdfb377eb9c6e5856320667956513ee6148b6fc1e484cef804ddaceedd7e57d
  • MD5 4fa54218c2ed6c2411fd908e62c796a1
  • SHA1 3e599617176d88335dd5c763a0a6f210e9b06c92
  • SHA512 5463f0c7b334e9507f7bc0f8e9f54caebd38be0073918187dd284c9dc0a57ae25f215334344f095495178fddabb92ba32447e0e8884020271d7d0a044970502b
  • SSDEEP 98304:R6zc7pYmae+aOs9Ph6KbdASANRcj18j2TMWzqV2g1Lwb6xyIWr/x0GJd:ROcSzIP6Kxhs1Lw+TC/xt
  • TLSH
    T1F8063A00A75CA472552FD72CF636EEAC951E204321C9CF5C306D9A34B66EE47A38D6E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2