Extracted

• • Target
    ShippingDocs BL-PL.JS
  • Size 3.8MB
  • SHA256 bf21c58a2109852055ba0e0719eeb2ff47000b276a0b5d58cdaf1611ea68235f
  • MD5 89b467bf34a15352e46ba9674bb68fe9
  • SHA1 5c7c150bf4c6781a167e57b4ec4b0bc4b46a5e96
  • SHA512 18cc89a8eb994c455fe370e189758f8a2594ec92f599d563974b413b3b3311f9e0e3df28383ea88fefdde6a0120a8cc7a5b57aa06a816ed57b16f55a2641177e
  • SSDEEP 98304:4YIgu8wm/bRWAutkD2KjhYYbk/hlzjlEcGSKvjc6Y61XLvy5Hx7:4Pgmm/oAPZrbk/hNRGSF6Y61b65H5
  • TLSH
    T13106C5850F9488777B68A70C6977EA60A30A5A0314E5DF46306EC398BB1CD577328BDF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2