Extracted

• • Target
    Quotation.JS.js
  • Size 3.2MB
  • SHA256 6727a54d383dd4e1de52c48cb29b16c0b054e6cf21aad99c7586a8b58ed53ba5
  • MD5 d306e336a29e98838e192274d806675c
  • SHA1 64db483dc913e3c3f46b9970d783d7a0e78294b9
  • SHA512 9f44c216b52f4c1161db244618a0b000bd5e09452470873fb610d005da9350f7d703de3ed2cb22b5febc06bcb6a3d5713a59797de342e5942216ba8b89734195
  • SSDEEP 98304:IG0kplPI5SaohxmY2tT6s8OPHknoHQ/k9vlQvDyj8ubT+ueEX/esjdRqix6m+o:f0kLGohxmYgF8OPEgj9vlOwesjnf
  • TLSH
    T17DF50870832477B4666D872CD136AF284A1E600F26F8FF0C366D52687654F4BAB8D1E7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2