Extracted

• • Target
    Enclosed attached our new PO.JS
  • Size 3.2MB
  • SHA256 8330e8047628c19f7baf8209a7738363cfae65271300b8c197fb08c69d8780d7
  • MD5 76db125ca0177bff54ff65a07c6d512e
  • SHA1 6986b429662a8521349e5a55fd9a81a77d9abe19
  • SHA512 270f3c477d863629ec87fc54c5e1c34bbaa53ea677997a97cab4f1f93488638c83318750680622dc68d8e677e02557c3ba08be1cbe71ea712afdd505922ae367
  • SSDEEP 98304:guHp9Iqhe6uqh2JvBwL1rVJElWrGyn+LoC/8DDBuGhVEW+Dzu152tCOf5p:DvIqcOh2JvBQpfTGTkC/8DxhVEPHIOr
  • TLSH
    T148F57D504328AA7066BED33CD136AF68454E300365D8EF1D35BE4A24B6A5F47A78C9F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2