Extracted

• • Target
    177EJWJWJ211742S MBL.js
  • Size 1.6MB
  • SHA256 537932910ad80de0f5cca839bccea17937d472e7dc764b23fee20917aa5bba41
  • MD5 f6e2eeb84dbb66f97a4bb5b5dfb424d0
  • SHA1 61005eb4b77bf16b511d4b12a2d4300fd9b71e28
  • SHA512 c3d789f43c26a28055acbb9117c04c5e71cf5ebc46bb6cfc291b79ba88468468f3358e14a8ddc52674daad09484aa32455a587cbbf0638e6f0c83ddd14cd45d3
  • SSDEEP 96:mu2x4648Z/QIdQnQMQi2/4xm+kQvSezHyQR4qA4Zp4n/fEhCs240LlD3AhQnQn26:b2Ds2cHI2656
  • TLSH
    T1BA858D99C35A465CFE29E310CF0906E1FD78C19A9A365C677DB8B0D614BE220D890FB7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionpersistencecollectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2