Extracted

• • Target
    Info_New_Order_7132026 _PDF.shtml(~99 KB).JS.js
  • Size 3.5MB
  • SHA256 8e7009c4804c4cf7b0192f8c6c7f3e080ebb4a447fc68fc6312b8f5e2f7fe452
  • MD5 1351c8b0f91bc0184123103cc81b9442
  • SHA1 b8b3f288c7639bed0076986a8d43fc281a5466ef
  • SHA512 a9e473c0ed829bdd152bf7add55fc291d705d4500d85c1d16a93c13d858ee488ae4afd8954f5cf01d21c2ab20fa5d520fe1002df48beb200b2ac253f6c29b46e
  • SSDEEP 98304:PbDgnOz0yeOG1rUufBk5QssTgJby+o4k3fYQEKsmZNrz5nVsv2wAfujLdptCQc:P5ZArUwkGssTeoLzmU11n+OwAmd6Qc
  • TLSH
    T19C06F6006B649572A71EE76CD676AE78880E600331EDCF0C704E96647939D0FB769BE3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2